100

Suppose that I tell you that I require you to cease posting here, immediately come round to my house, and cook me lunch. Your first response might, very reasonably, be "who on earth is this person and why should I spend my time and energy fulfilling his agenda instead of my own?". It's not that demanding new features in open-source projects is ...


72

Companies produce open source software for a variety of reasons, including marketing and developer relations. But I don't want to speculate. Instead, I want to point out three aspects: Browsers don't have any secrets that must be protected. Chromium is derived from a tradition of open source components. Google benefits from the reach and impact that open ...


49

I'm not a native English speaker but to me "demanding" implies having authority. A policeman can demand that you show your hands; a teacher can demand that the students be quiet. A parent can demand that the children wash hands before dinner. If you indeed use that word or behaved like the authorities in these examples you imply having authority ...


30

In addition to Mureinik's excellent point, there is a general move towards reproducible builds in FLOSS, which provides a useful halfway house between build it yourself and distributor publishes a single checksum. Once the build toolchains are reproducible (that is, a given toolchain repeatably compiles a given set of reproducibly-buildable sources into ...


23

There is not much which would disallow that. The MIT license is pretty liberal and as long as one obeys the requirement to display the copyright notice in the product appropriately, there's not much one could do against that other than offering the better product and/or service. See also the excellent answer by congusbongus in this similar question as well ...


21

Google is broadly not in the business of selling copies of software. Google is in the business of offering Internet and Web services, most often accessed through a browser. The overwhelming dominance of Chromium clones that you suggest in your question has already happened: Opera, Edge, and Chrome are all Chromium-based. Firefox and Safari are the only major ...


18

Firstly, this is against the spirit of open source; if you don't want people exploiting your work without paying you, don't use open source licenses in the first place. rebranding However, you do have one option: you can protect the branding itself by registering the name as a trademark. "Red Hat" is a trademark. Other people can't call their ...


18

It's not wrong to ask for features in open-source projects. Preferably in a gentle and well-educated manner. Of course, the people maintaining it are under no obligation to fulfill that. Quite often, you might find that they don't implement it right away, but it stays there, awaiting someone motivated enough to do it (this could range from yourself coding it ...


18

Nearly no way if we talk GPL. If you use GPLv3 code in your project or you use it for reference for a re-implementation or port, you are bound by the license. That's the point of a license: you are given permission to use the code on the conditions stated in the license. Without license you would not have legal access to use it at all. If you call the n2n ...


16

Let's refocus the question to address the security aspect of https://github.com/echojs/echojs/issues/12 (other great answers already address the tone of demanding a fix and calling for a volunteer project to be shut down). When I complain about some software vulnerability there is always someone who says "Instead of reporting/demanding this, just ...


16

You don't need to do anything. Open source licenses derive their power from copyright law, and neither copyright law nor the Apache license itself care about the name under which a product is released. Looking at this a different way: if I took your code and released it under a different name, something I am perfectly entitled to do so long as I maintain the ...


15

As a general problem, I'm not aware of a robust way to validate that a given binary matches a given source repository (see, e.g., this discussion on Security.SE). Ultimately, it boils down to a question of trust. The most reliable solution is to build the given sourcecode yourself and not rely on the published binary (although you still have the question of ...


15

Short answer: You can't. There's a famous paper Reflections on Trusting Trust by Ken Thompson about how the compiler itself could be inserting the malicious code, including when compiling itself. The best way would be to build the app yourself, or have it built by some entity you fully trust for this. Maybe you don't have the knowledge or tools yourself, but ...


13

By making Chromium open source, Google succeeded in turning almost all competing browsers into rebranded copies of Chrome and getting to set all the baseline behavior/policy that would go into them. This would not have happened if it were not open source (either by virtue of not having source available, or not being licensed as open source, or both). It's ...


11

Reading "Business Model Generation" by Alexander Osterwalder helped me understand a) how businesses actually work, b) how selling software actually works, and c) how open-source companies (among others) do it. https://www.goodreads.com/book/show/7723797-business-model-generation In a nutshell, any company is going to need developers, maintainers, ...


11

I was wondering if this license would hold any water or if it is legal. My legal knowledge is nil. This screams "BAD IDEA" at me. There's a reason that lawyers train for as long as they do. Legal documents are tricky and hard to get right unless you know exactly what you're doing; often, you may be able to do something that mostly does what you ...


10

Yes, it is wrong to demand anything of open source projects. Open Source developers tend to first and foremost implement features or work on bugs that are relevant to themselves; and secondarily they will work on features that bring the software further along because the changes are useful and "good" (subjectively speaking, in the opinion of the ...


10

You are thinking very much about Git, and not at all about the existing MIT license. You can just copy Jack's code. You do have explicit permission – the MIT license under which you received Jack's code. This license only has a single condition: that you keep Jack's copyright + license notice. If you want to preserve Jack's Git history you'll have to do ...


8

To quote from the MIT License: THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN ...


8

Section 4(c) lists the only obligations you have with regards to copyright notices: You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; If there are zero of ...


8

The license of an application and the license of data that application produces can be independent, and are only interrelated if the data includes executable code from the executable itself: Is there some way that I can GPL the output people get from use of my program? For example, if my program is used to develop hardware designs, can I require that these ...


7

It is true that the developer of the original application can be malicious: Ken Thompson's famous (and seminal, and also very readable) paper "Reflections on Trusting Trust" makes clear just how deep that rabbit hole can go. Absolute security is very difficult to achieve, and free software is not a perfect remedy for this. But between absolute ...


7

The MPL-2.0 license does not require that Contributors add a copyright notice or in another way mark files as changed and it also doesn't contain any explicit clauses about mis-representation. Based on that, there seems to be no violation of the license, although you might look deeper in the copyright law of your country if it states anything about mis-...


7

Software published under a Free or Open Source license do not put any restrictions on how the software can be used - that is one of the fundamental freedoms in both the Free Software Definition and the Open Source Definition. However that doesn't mean that your actions using FOSS software can't be illegal. It is illegal to commit fraud, identity theft, ...


7

TL/DR: Yes, Open Source licenses are valid in Turkey and nearly globally. Open Source copyright licenses are based on copyright law. While each country has its own copyright laws, there is an international agreement (the Berne Convention) in which countries have agreed to have certain commonalities in their copyright laws. Turkey is one of the signatories of ...


7

The GPL FAQ addresses the issue of "mere aggregation", when it writes An “aggregate” consists of a number of separate programs, distributed together on the same CD-ROM or other media. The GPL permits you to create and distribute an aggregate, even when the licenses of the other software are nonfree or GPL-incompatible. I see no reason why ...


7

Expanding on Philip Kendall: Licenses don't stop working because you changed a name. The product also isn't "stuck" on the specific license. It only regulates what OTHER people can do with the software. Ever notice how these licenses usually don't have a name in them? Because they usually apply to the software, or even just the piece of work they ...


7

Are the old commits in project A with MIT still considered MIT? No, that code was never licensed under the MIT license: the individual(s) that made that offer to you never hard the right to make it in the first place. You may as well ask if the deed to the Brooklyn Bridge that you bought in an alleyway is still valid, even if the state of New York told you ...


6

The requirement to have a copy of the MIT license and pytest copyrights only applies to those sites/repositories that actually host a copy of pytest itself. What many open-source projects do is that they don't contain the code for their dependencies, but only a configuration file that instructs a package manager to retrieve the relevant dependencies from the ...


6

Your guarantee is political, not technical. If a government publishes an app that collects some personal information in the background, nothing much will happen if that’s later revealed. But if a government publishes source code and claims it’s the code for their app, but it’s later revealed that the published app wasn’t based on that source code, it will be ...


Only top voted, non community-wiki answers of a minimum length are eligible