4

I made a small library which I decided to open-source under the Apache 2.0 License on Github.

Not long afterward I realized that some of the code in here makes use of proprietary information which belongs to the third-party company (let's say that it's the structure of the packets of data) and the fact that anyone can find that structure on the Internet (there're at least two libraries and dozen of articles which describe that structure in great details) does not mean that I can use it in my open-source code. Now, I can write an abstract parser that would handle that format of data and, possibly, some other formats, but the question is - how can I release it so that the company can not claim that I was redistributing their proprietary info?

Is it enough to put some commits on top of the existing code which will destroy all mentions of hard-coded proprietary data package structure? I don't think so, because anybody can check the Git log and see that information here.

Should I add this abstract parser in a new commit and then squash all existing commits into a huge single commit, so that there will be no evidence that this reliance on proprietary info has ever existed in the first place?

I wouldn't want to destroy the overall history of the repository, but if that's the price that has to be paid, then I'm fine with that.

  • Did you contact a lawyer? What did he said to you? Who is the copyright owner? if done on your work time, what does the work contract says about copyright ownership of code? What legal system is relevant? French copyright laws and interpretation of license is not the same as in California. – Basile Starynkevitch May 12 at 19:13
  • How did you obtain the proprietary information? Did you sign any NDA? Did you obtain that information by illegal means (torture, violence, ....)? – Basile Starynkevitch May 12 at 19:34
  • git filter-branch is a tool that allows you to remove an unwanted file from all commits in a git repository's history. This is a history rewriting tool, so treat it like git rebase -- you can break things with it. Super useful if you accidentally commit an ssh key or something. – Sean McMillan May 14 at 20:12
5

I would question your assertion that you cannot use the information in your library. Copyright is about the expression of an idea, not the idea itself. So long as somewhere along the line, you have a clean break from the original implementation - for example, if you coded your implementation solely from one of the descriptions of the data structures, rather than by looking at the proprietary code - then the copyright on the original does not apply and you can use it in your library.

This assumes that there aren't other forms of intellectual property, most likely a patent, protecting the information. If there is a patent, that's a whole different problem, and not one that open source software can solve because the whole idea is protected.

| improve this answer | |
  • While I agree with you, there have been attempts to try to copyright an API in the past. I'm not sure if there have also been attempts to copyright a network protocol. – curiousdannii May 8 at 1:50
3

how can I release it so that the company can not claim that I was redistributing their proprietary info?

This depends on what you mean by "proprietary info".

If the company had a document that described a network protocol, that document could be considered "proprietary information" by the company.

Any derived documents (such as format conversions or reformattings into tables/lists) would also be considered "proprietary information" by the company, if they consider the original document "proprietary information".

If the protocol was reverse engineered without using any company-owned documents, I would consider the result of such reverse-engineering not "proprietary information" of the company but 1) I am not a lawyer, 2) the company could argue that the protocol wasn't reverse engineered but a document was consulted. The most prominent example of such reverse-engineering that I know of is Samba.

If by "proprietary info" you mean a particular implementation of the protocol by the company, and not a description of the protocol, then by creating an implementation from scratch without referencing any of the code of the company's implementation should eliminate the issue of the use of company's code. At this point depending on how valuable the protocol is to the company they could still claim that 1) the protocol is proprietary in which case you'd need to back to reverse-engineering it or 2) they hold patents on the protocol in which case you may not be able to use it at all without a legal battle.

I wouldn't want to destroy the overall history of the repository

If your repository contains code that you are not legally allowed to distribute, such as because it is owned by the company and the company hasn't given you permission to distribute the code, you should remove it from history to avoid legal issues.

Same applies to documents or notes that contain what the company may consider "proprietary information", if you are not allowed to distribute it you shouldn't have it in the repo.

| improve this answer | |
0

How to completely get rid of proprietary code in the library?

I am not a lawyer, but you could consider providing some plugin machinery in your library.

In some legal systems, a plugin machinery might be a technical solution to your problem.

who owns the copyright of your code

(and how many millions of US$ or € are available to the copyright owner)?

In practice, contact a lawyer, but don't worry that much. Most of open source code is not relevant to most people. There have been lawsuits (e.g. Google vs Oracle) showing the opposite, but most open source libraries are not that important.

If you made alone a small library open source, and if you don't have millions of US$ in your bank account, you should not worry that much. It is likely that your library is small (just a few dozen of thousands of source lines) and used by few people.

If you have a boss or a client who asked you to code that library, raise that issue the next time you speak with him.

Even if your case go to court, the judges are human and all of them now that errare humanum est. You are allowed to make mistakes like you are allowed to make bugs.

IIRC, in Europe, you legally are allowed to reverse engineer network protocols. Things are different in the USA.

You could delete your github repository entirely and just publish the tarball of your code on the website of your choice. FWIW, the Fox Toolkit is LGPLv3+ but without any public git repository. In practice, it is unlikely that you'll get sued.

the fact that anyone can find that structure on the Internet (there're at least two libraries and dozen of articles which describe that structure in great details) does not mean that I can use it in my open-source code

AFAIK (and that was told to me by French lawyers) that above claim is wrong. Of course you need to go to court to be sure.

contact your lawyer

Do you have an idea of how many hundred thousands downloads your library has gotten? Show also to your lawyer the output of sloccount on your source code.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.