Octotree censorship / AGPL violation #1

christianbundy · 2020-10-31T18:59:32Z

Since @buunguyen has decided to suppress this conversation via censorship, I thought I'd move the discussion here.

Previous discussion -- Proprietary Firefox extension contains AGPL-licensed code ovity/octotree#1040
Archive (with deleted evidence) -- https://web.archive.org/web/20201031182128/https://github.com/ovity/octotree/issues/1040

Thread summary

This thread is long, I've summarized it for folks who are just now tuning in.

EDIT: This thread has devolved into uninformed opinions by drive-by commenters. I've already explained all of the basics multiple times throughout the thread, and honestly don't have the energy to engage with people who can't be bothered to read what others have already written. I have unsubscribed to this thread.

TL;DR

Contributions to the Octotree project were licensed under the AGPL, which requires that all improvements are also published under the AGPL. Octotree is now closed-source, and @buunguyen is claiming that it's a "complete rewrite", but I've looked at the proprietary bundle (octotree.zip`) and it doesn't look like a rewrite to me.

Example

AGPL

From src/view.tree.js:

_showHeader(repo) {
  const adapter = this.adapter;

  this.$view
    .find(".octotree-view-header")
    .html(
      `<div class="octotree-header-summary">
        <div class="octotree-header-repo">
        <i class="octotree-icon-repo"></i>
        <a href="/${repo.username}">${repo.username}</a> /
        <a data-pjax href="/${repo.username}/${repo.reponame}">${
        repo.reponame
      }</a>
        </div>
        <div class="octotree-header-branch">
        <i class="octotree-icon-branch"></i>
        ${deXss((repo.displayBranch || repo.branch).toString())}
        </div>
        </div>`
    )
    .on("click", "a[data-pjax]", function (event) {
      event.preventDefault();
      // A.href always return absolute URL, don't want that
      const href = $(this).attr("href");
      const newTab = event.shiftKey || event.ctrlKey || event.metaKey;
      newTab ? adapter.openInNewTab(href) : adapter.selectFile(href);
    });
}

Proprietary "complete rewrite"

From octotree.zip/src/content.js (both formatted with Prettier for easier comparison):

_showHeader() {
  const e = this._adapter,
    t = e.getRepo();
  this.$view
    .find(".octotree-view-header")
    .html(
      `<div class="octotree-header-summary">
        <div class="octotree-header-repo">
        <i class="octotree-icon-repo"></i>
        <a href="/${t.username}">${t.username}</a> /
      <a data-pjax href="/${t.username}/${t.reponame}">${t.reponame}</a>
      </div>
      <div class="octotree-header-branch">
      <i class="octotree-icon-branch"></i>
      ${I((t.displayBranch || t.branch).toString())}
      </div>
      </div>`
    )
    .on("click", "a[data-pjax]", function (t) {
      t.preventDefault();
      const i = $(this).attr("href");
      t.shiftKey || t.ctrlKey || t.metaKey ? L(i) : e.selectFile(i);
    });
}

The text was updated successfully, but these errors were encountered:

christianbundy · 2020-10-31T19:00:12Z

CC:

christianbundy · 2020-10-31T19:03:14Z

CC:

zacanger · 2020-10-31T19:03:19Z

If you're interested in it, I branched off from the commit before they removed the license over in my copy, and am working on getting dependencies up to date and making sure it still builds right now. Like I mentioned on the original issue, I'm not particularly bothered about the license violation (including AGPL code in a proprietary product) because my contribution was only one line, but changing the FOSS version to source-available unlicensed (or whatever the intention was behind deleting the license) was not okay.

Lattyware · 2020-10-31T19:12:23Z

I would suggest that looking for a significant chunk of code that can be clearly traced back to a change where the current team do not control the copyright (i.e: from a contributor other than them who did not assign them the rights) would be the smoking gun here.

While their response has been terrible, they could in theory legally do this as long as they only used code they have the copyright for and can re-license.

I'm in no way involved, to be clear, just came across this (and very much not a lawyer, just my layman's understanding). The response from them is just... ugh.

christianbundy · 2020-10-31T19:55:40Z

I would suggest that looking for a significant chunk of code that can be clearly traced back to a change where the current team do not control the copyright (i.e: from a contributor other than them who did not assign them the rights) would be the smoking gun here.

Good idea, here's an obvious one from @jdreesen: ovity/octotree#861

If you look through the output of git-blame you can see that many of the lines were either authored by @jdreesen or adapted from his code. (You can click 'view blame prior to this change' to verify the provenance.)

And of course, if we look in the "complete rewrite" we'll see that it's an obvious derivative:

_handlePjaxEvent(e, t, i) {
  if (!this._isDispatching) {
    this._isDispatching = !0;
    try {
      if (($(document).trigger(t), null == e.originalEvent)) {
        const e = $(this.pjaxContainerSel)[0];
        e && e.dispatchEvent(new Event(i, { bubbles: !0 })),
          "pjax:end" === i &&
            $(".UnderlineNav .UnderlineNav-item").removeClass(
              "selected"
            );
      }
    } finally {
      this._isDispatching = !1;
    }
  }
}

Bonus points: You can clearly see that the minifier inlined @jdreesen's _dispatchPjaxEventInDom() as in the above fragment as:

const e = $(this.pjaxContainerSel)[0];
e && e.dispatchEvent(new Event(i, { bubbles: !0 }));

christianbundy · 2020-10-31T20:08:22Z

Maybe useful: git-blame line count per author:

$ for f in $(git ls-files); do git blame --line-porcelain $f | sed -n 's/^author //p'; done | sort | uniq -c | sort -rn
  53442 Buu Nguyen
   1730 NDQ
    102 Phi Nguyen
     77 Fahme Bnchi
     57 An Le Phu Nguyen
     52 Will Simons
     30 Jacob Dreesen
     18 Danh Nguyen
     11 Samvel Abrahamyan
     10 Rico
     10 duylam
      6 Xiao Tan
      6 Fiete Börner
      5 Steven Noto
      4 Ahmed El Sayegh
      3 GyuYong Jung
      3 Duy Lam
      2 Yuichi Tanikawa
      2 Andrew Levine
      1 Zac Anger
      1 Kevin Conaway
      1 Ephemera
      1 Brightcells

Fahme · 2020-10-31T20:20:30Z

Hey,

I’m @Fahme in your CC list and I was hired to work on Octotree. I’m no longer involved, but I was there when we rewrote Octotree. Just so you know.

buunguyen · 2020-10-31T20:23:45Z

Thanks for making the list. I want to point out the following people are (or were) in the core team and all of them are paid to work on Octotree. Thanks for trying to make our lives difficult even though we write 99% of the code in the old version and probably 99.999% of the new version.

 53442 Buu Nguyen
   1730 NDQ
    102 Phi Nguyen
     77 Fahme Bnchi
     57 An Le Phu Nguyen
     18 Danh Nguyen
     10 duylam

Also, as to why I changed the license, it's because of this kind of harassment. It is not the first time but at some point, enough is enough. See this post for more context.

tbodt · 2020-10-31T20:25:58Z

I think not reverting the contributions of people not in that list might be a violation of copyright law. I'm not a lawyer though, you should ask one to be sure.

judge2020 · 2020-10-31T20:27:59Z

@buunguyen:

I want to point out the following people are (or were) in the core team and all of them are paid to work on Octotree.

Assuming you have the legal stuff sorted for those contributors (they have signed a CLA/assigned their code to no longer be AGPL), you still need to get assignments from the other contributors to designate their code as non-AGPL (NAL).

christianbundy · 2020-10-31T20:31:52Z

I want to point out the following people are (or were) in the core team and all of them are paid to work on Octotree.

Thank you for this information. Could you confirm whether you received relicensing consent from the other 59 contributors?

Thanks for trying to make our lives difficult even though we write 99% of the code in the old version and probably 99.999% of the new version.

I don't want to make your life difficult. You said that the proprietary version was a "complete rewrite", and when I provided evidence to the contrary you deleted it and banned me from interacting with your repository.

Also, as to why I changed the license

...but the license isn't yours to change. The project is a derivative work from dozens of contributors, and if you'd like to change the license then you need their consent. This is literally the entire point of copyleft, which you know, and is why you played the "complete rewrite" card.

Please just be honest.

Lattyware · 2020-10-31T21:22:49Z

Thanks for trying to make our lives difficult even though we write 99% of the code in the old version and probably 99.999% of the new version.

...

Also, as to why I changed the license, it's because of this kind of harassment.

All the more reason your response is baffling, because contacting the few other people to ask them to sign off on the re-license would have been easy. Instead, you seem to try to obscure the truth by calling it a complete rewrite and getting aggressive with anyone bringing up the issue.

It sucks if people harassed you, but people making real, good-faith points about you re-licensing without the permission of some of the authors is not harassment. Even if it was, it wouldn't somehow give you the right to act unilaterally to try and claim other people's work.

Please, put yourself in the shoes of other people here: you are telling people that code they write could end up being used in proprietary software when they contribute it to projects licensed under open licenses. That clearly isn't OK, and it being a small percentage of the code in question simply doesn't address the core problem.

buunguyen · 2020-10-31T21:24:03Z

@christianbundy
You were banned because you were dishonest and spammed me. You started all this with this assertion:

it's easy to verify that it uses the same code from master with small changes

After I pointed out that it was not true, instead of admitting you didn't look at it carefully enough, you doubled down on the accusations and posted spams CC'ing a bunch of people. Not only that, you even emailed me repeating the same things, as if all these GitHub issues weren't enough! Do you often harass people like this? If people like you only spent half of such effort in contributing to Octotree instead of attacking me, I wouldn't have had to hire a team to work on it or introduce the paid plan so that we could keep the software alive.

The bottom line is this:

My team wrote ~99.9% of the old version of Octotree (based on the stats you provided yourself).
We rewrote Octotree and the source of this version is closed. There might be some bits and pieces that were adapted from the old code, but it doesn't mean we didn't rewrite Octotree from scratch. A software developer should understand that.

@zacanger
I just wanted to stop the trolling. I really don't care if it's AGPL or unlicensed. I would change it back to AGPL in a heartbeat if I knew it would stop the trolling. But I find it impossible to make everyone happy. Some people just want other people do work for free for them. You wouldn't believe how many hate emails I've received since start charging for Octotree, this isn't the first time. I just need to find ways to keep those people away.

Lattyware · 2020-10-31T21:31:44Z

The bottom line is this:

My team wrote ~99.9% of the old version of Octotree (based on the stats you provided yourself).

We rewrote Octotree and the source of this version is closed. There might be some bits and pieces that were adapted from the old code, but it doesn't mean we didn't rewrite Octotree from scratch. A software developer should understand that.

The bottom line is that you don't get to define if other people's contributions are important. They contributed work on the basis of a particular license, you can't use it without following that license. You need to contact them and ask them to give you the rights, or rewrite those segments, but it appears that you haven't done that in at least one case. If you believe you have, then all you have to do is actually answer the question to put people's minds at rest, rather than painting people acting in good faith as harassers.

No one is complaining about you making a proprietary product here. You just can't take other people's work to do it, even if it is a relatively small proportion of the overall thing. Telling people you only re-licensed a little work without asking is understandably going to lead to people saying that isn't good enough.

You are absolutely entitled to profit from your work. It's just a bit incredible to use that as a defence for denying someone else the right to license their work, however small.

hyiltiz · 2020-10-31T21:48:39Z

I would change it back to AGPL in a heartbeat if I knew it would stop the trolling. But I find it impossible to make everyone happy.

I am fairly certain that once you @buunguyen change it back to AGPL, everyone who is "trolling" you @buunguyen will stop.

christianbundy · 2020-10-31T21:50:25Z

You were banned because you were dishonest and spammed me.

No, I was banned because I posted evidence that you didn't want other people to see. The archive doesn't lie, and you shouldn't either.

After I pointed out that it was not true [...]

Not once have you actually addressed the code that I've pointed out. It's incredibly clear that your proprietary product is a derivative of the AGPL work with 66 contributors, and instead of admitting it you've:

censored comments you don't like
equate questioning with "spam", "harassment", and "trolling"
fabricated a "complete rewrite", which you seem to still assert (?!?)

You're now attempting to gish gallop your way through the discussion without actually addressing any of the points made, and I'm not interested in that at all. If you want to have a two-way conversation here, you're more than welcome to do so, but we're not going to do the one-way conversation style that you seem to prefer.

buunguyen · 2020-10-31T21:50:37Z

rather than painting people acting in good faith as harassers.

If you seriously believe the OP acted in good faith after hearing my side of the story, we're very different.

but it appears that you haven't done that in at least one case

You mean this case? First, to be absolutely clear, I value all contributions and I honestly wish I received enough contributions so that I didn't have to introduce the paid plan to pay people to work on it.

Now, if you looked at that code closely, you would see we rewrote and made it much more robust. If we didn't rewrite certain lines made by contributors it was because we couldn't think of any other way to do it. I mean, how many ways you can call a certain API like dispatching an event?

christianbundy · 2020-10-31T21:51:46Z

Now, if you looked at that code closely, you would see we rewrote and made it much more robust.

Oh, like a derivative?

First, to be absolutely clear, I value all contributions and I honestly wish I received enough contributions so that I didn't have to introduce the paid plan to pay people to work on it.

I want to be very clear: I want you to get paid for your work, and there's nothing wrong with your paid plan. I do not want you to renege on your license agreement or lie about the fact that your proprietary product is a derivative of AGPL code.

buunguyen · 2020-10-31T21:52:20Z

I am fairly certain that once you @buunguyen change it back to AGPL, everyone who is "trolling" you @buunguyen will stop.

They trolled me when it was still AGPL. That's the ONLY reason I had to change it to unlicensed.

buunguyen · 2020-10-31T21:53:32Z

Now, if you looked at that code closely, you would see we rewrote and made it much more robust.

Oh, like a derivative?

See, your dishonesty shows. Way to quote something out of context.

Now, if you looked at that code closely, you would see we rewrote and made it much more robust. If we didn't rewrite certain lines made by contributors it was because we couldn't think of any other way to do it. I mean, how many ways you can call a certain API like dispatching an event?

christianbundy · 2020-10-31T22:00:11Z

See, your dishonesty shows. Way to quote something out of context.

I'm actually impressed at your ability to deflect and avoid addressing anything anyone else says.

They trolled me when it was still AGPL. That's the ONLY reason I had to change it to unlicensed.

Can I get a link please? I want to believe you, but our relationship has been off to a rocky start.

Lattyware · 2020-10-31T22:03:00Z

rather than painting people acting in good faith as harassers.

If you seriously believe the OP acted in good faith after hearing my side of the story, we're very different.

I do, and I have no skin in the game here. I think you are letting a genuine bad experience colour your interaction with others, and it is escalating. I would recommend taking a step back, and re-engaging with the assumption people are just being genuine here and trying to ensure the AGPL isn't being violated.

You came out swinging, and only revealed a lot of key details after multiple attempts where you have deleted people's comments, closed issues as spam and so on, rather than just responding. I can understand how you might assume bad things given previous issues, but that certainly isn't my read from what I saw of this.

but it appears that you haven't done that in at least one case

You mean this case? First, to be absolutely clear, I value all contributions and I honestly wish I received enough contributions so that I didn't have to introduce the paid plan to pay people to work on it.

Now, if you looked at that code closely, you would see we rewrote and made it much more robust. If we didn't rewrite certain lines made by contributors it was because we couldn't think of any other way to do it. I mean, how many ways you can call a certain API like dispatching an event?

I'm no lawyer, and I'm sure there is an argument about trivial similarities in reimplementation, but as you have stated that you used their code and left small parts of it unchanged, not just that you recreated trivial parts incidentally, my understanding is that is making a derivative work based on the other person's, not making a separate implementation.

Fundamentally, people are just trying to look out for other open source contributors and ensure their work isn't being used in a way they wouldn't like. Why not just contact these few people and ask them to allow you to use their work? I really can't believe most people would have any issue with it, and if they do (or you can't contact them), a clean-room re-implementation should be easy if we are really talking about trivial code.

To say you value contributions, while freely admitting you didn't do so enough to contact people to ask to use their work, while also complaining about people being unwilling to let you value your work... I can understand why people think you are acting in bad faith.

buunguyen · 2020-10-31T22:04:38Z

Can I get a link please? I want to believe you, but our relationship has been off to a rocky start.

ovity/octotree@9da83c4

I'm actually impressed at your ability to deflect and avoid addressing anything anyone else says.

I'm actually more impressed that you were being dishonest right from the start, never admitted you were wrong in your accusation even though I have been very clear about everything in my responses.

morotti · 2020-10-31T22:06:05Z

FYI: This bug report made it to the hacker news front page so it may a get a lot of viewing very soon https://news.ycombinator.com/item?id=24953821

One very important point that's been missing from the hundreds of commenters so far is that there are some constraints for code to be copyrightable, like the work has to be original.

It's not 100% clear cut what is copyrightable but a typo correction or a half-line edit would most likely not qualify.

One comment had some statistics showing that most of the contributors contributed very little (many a single line change). Should review the changes for what may actually be copyrightable. That should reduce down the copyright issue significantly.

IMO: could remove the typo commits and similar. Alter the git history, remove the commit, redo, force push. It might make the open source community cringe but it should be fine legally.

hyiltiz · 2020-10-31T22:11:36Z

One comment had some statistics showing that most of the contributors contributed very little (many a single line change). Should review the changes for what may actually be copyrightable. That should reduce down the copyright issue significantly.

Good call!

IMO: could remove the typo commits and similar. Alter the git history, remove the commit, redo, force push. It might make the open source community cringe but it should be fine legally.

No! Re-writing history probably is never a good move. Instead, consider simply writing up a short report from the above investigation, and explicitly state the status of each contributor's contributions:

not copyrightable due to fixing a typo
original author relicensed
original author assigned ownership
clean-room reimplemented by X based on the spec Y produced by Z
rewritten by X based on Y thus may still be problematic etc.

zacanger · 2020-10-31T22:12:48Z

Another option that would probably be acceptable to most people involved would be relicensing under BSD or similar, which would solve all these problems as long as contributors consent to that change. Doing that up front would've saved a bit of stress for a few people today, I bet :)

hyiltiz · 2020-10-31T22:17:06Z

Another option that would probably be acceptable to most people involved would be relicensing under BSD or similar,

Reverting back to AGPL is much easier and less problematic than ~~reverting back~~ migrating to to BSD; relicensing AGPL to BSD leads to very similar problems as outright close-sourcing an community-contributed AGPL program.

buunguyen · 2020-10-31T22:23:26Z

I do not want you to renege on your license agreement or lie about the fact that your proprietary product is a derivative of AGPL code.

We talked about this, didn't we?

It's a shame you didn't act in good faith right from the start by making a blatantly false accusation, which you never admitted you probably had come up after a cursory look. And you keep calling me a liar even though I have explained everything very clearly.

So no, I do not understand what you really want.

ddevault · 2020-10-31T22:42:30Z

@buunguyen, you weren't acting in good faith when you created a closed source fork. You are not legally allowed to do this, and you knew you were not allowed to do this. If you're trying to create a legitimate business then you had better change your tune before you get legitimately sued.

"It is hard to make someone understand something when their paycheck depends on their not understanding it."

Well, I hope that paycheck covers the legal fees and damages which you're about to acrue.

Have some respect for the contributors who have helped you, for the licenses you have chosen, and the bountiful free software community on whose shoulders you stand.

buunguyen · 2020-10-31T22:47:50Z

Reverting back to AGPL is much easier and less problematic than reverting back to BSD; relicensing AGPL to BSD leads to very similar problems as outright close-sourcing an community-contributed AGPL program.

Done ovity/octotree@29fa675

As a context for the people who just came here, I removed the license a few days ago because I was tired of people asking me why I didn't open-source the full Octotree version. Over the last 1.5 years since I started charging for certain functionalities in Octotree, there have been dozens and dozens hate emails, comments, insults and threats targeting me. On the contrary, during the 4+ years I created and maintained Octotree completely free and open-source, I couldn't recall 3 people who personally thanked me for my work. Such is the life of being an open-source maintainer.

christianbundy · 2020-11-02T16:22:12Z

so long as the infringement is dealt with in a reasonable form.

@Lattyware Absolutely, but the Octotree team is doing the exact opposite of dealing with the infringement in a reasonable form. All they have to do:

Admit it
Fix it
Move on

They're stuck on step 1, and apparently think that if they say "complete rewrite" enough times that everyone will believe them. It's maddening, and honestly feels like trying to argue with a starfish.

Lattyware · 2020-11-02T16:38:43Z

so long as the infringement is dealt with in a reasonable form.

@Lattyware Absolutely, but the Octotree team is doing the exact opposite of dealing with the infringement in a reasonable form. All they have to do:
1. Admit it

2. Fix it

3. Move on
They're stuck on step 1, and apparently think that if they say "complete rewrite" enough times that everyone will believe them. It's maddening, and honestly feels like trying to argue with a starfish.

This is flatly untrue, earlier in this thread they committed to contacting contributors and asking for licensing or removing the offending segments of code, which I think is a very reasonable resolution to the issue given the situation (and, I would note, the only outcome I could imagine being likely from legal action, if—as seems unlikely at this point—anyone actually wanted to pursue that).

I said earlier that I thought your argument was in good faith at the start of this, and I would hope that is true and you just missed this in the admittedly busy thread, but your summary is just misleading and confrontational given the response.

ddevault · 2020-11-02T16:39:47Z

It would be more accurate to say that they've admitted it (that'll be useful in court, thanks!), but then tried to worm their way out of their legal obligation to release the source code as a conseqeunce.

christianbundy · 2020-11-02T17:29:58Z

You're right, I didn't realize they admitted that their closed-source fork was a derivative and that their "complete rewrite" thing wasn't true. That's very useful, but I'm still concerned about this:

Bottom line is I'll follow up with the remaining action mentioned in this post by reviewing the source to address any piece that is indeed proprietary, i.e. not written by me or my team and not obvious, like adding a string to the whitelist of reserved repositories etc.

But if you click the link, you'll see this:

That said, we'll trace through the code and if there are pieces we believe weren't rewritten, we'll either ask the original author to re-assign the license, remove it, or find a way to rewrite it.

This demonstrates a fundamental misunderstanding of what we're talking about: derivatives.

If you write add() and I rewrite it as sum(), I have to share my source.
If add() takes two arguments and I add support for a third argument, I have to share my source.
If I completely refactor add() using your implementation as my reference, I have to share my source.

The closed-source fork of Octotree is not a clean-room implementation, it's a derivative of the open source project, and unless they convince every contributor to give up their rights then they'll need to share the source code of their fork. Instead of trying to comply with the license, the Octotree team is trying to disenfranchise its contributors, but their preferred method doesn't even work. The whole point of the AGPL is that most code is inspired by (and derived from) previous code, and therefore it's intentionally difficult to dissolve the rights of the people who have contributed to your project.

Their options:

Follow the law and share the source code.
Convince all contributors to give up their rights.
Perform a clean room implementation of the project with zero shared provenance.
- Remember, they don't just need to reimplement AGPL contributions -- they need to reimplement any piece of code that has shared provenance with an AGPL contribution. If add() ballons to an 80,000-line library, the whole thing is covered under the AGPL and all contributors have the right to its complete source code.

Unfortunately "refactor all of the obvious AGPL violations so it's harder to notice" is not an option here.

max-hk · 2020-11-02T18:31:53Z

@christianbundy I don't think "Perform a clean room implementation of the project with zero shared provenance." is an option. They already have derivative works released to the Chrome Web Store, which, in theory, should fall under AGPL unless they convince all contributors to give up their rights.

Any new versions without AGPL licensed code from outsiders could be proprietary though.

quannt · 2020-11-03T00:36:38Z

Not a lawyer, but isn't the source code of the Pro version already provided to the end-user publicly. That's sort of how Javascript works, you guys know it, right? When you download the browser extension, you download the source code too, it's right here.

This whole drama started because @christianbundy was able to look at the source code of the Pro version, inspected it, and saw some similarities in the _showHeader. If the Pro version is really closed source, there would be no case. It's right here in his issue

Octotree is now closed-source, and @buunguyen is claiming that it's a "complete rewrite", but I've looked at the proprietary bundle (octotree.zip`) and it doesn't look like a rewrite to me.

Imagine how this would go in a court

They must release the source of the Pro version because there are similarities between the Pro version and the free one.
How do you know there are similarities between them?
Because I was able to look at the Pro source code and the free source code to inspect and ...
Then what are you suing them for

judge2020 · 2020-11-03T00:45:09Z

Then what are you suing them for

Given that some code currently in the distributed closed-source version was indeed contributed by someone not working for them and thus hasn't re-licensed it (or assigned it) to a different license, the agpl applies.

From the AGPL:

You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:

a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
b) The work must carry prominent notices stating that it is released under this License and any conditions added under section > 7. This requirement modifies the requirement in section 4 to "keep intact all notices".
c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.

Given that there isn't notice about AGPL code being in the release, and no copy of the AGPL, it is in violation of the licenses of other contributors' code.

reanimus · 2020-11-03T00:53:57Z

Not a lawyer, but isn't the source code of the Pro version already provided to the end-user publicly. That's sort of how Javascript works, you guys know it, right? When you download the browser extension, you download the source code too, it's right here.

Unless they're shipping unminified, I don't think you can call the shipped JS "the source".

quannt · 2020-11-03T01:00:43Z

@reanimus That's very much debatable and up to the court to decide, no? To me, it is the source code, unminified or not. Are we really starting a witchhunt because a guy ships his JS code minified? Doesn't it seem ridiculous to you?

The fact that @christianbundy was able to point out the similarities between the two versions of the method _showHeader clearly shows that the minified version of the source code is in fact the source code.

reanimus · 2020-11-03T01:02:48Z

@reanimus That's very much debatable and up to the court to decide, no? To me, it is the source code, unminified or not. Are we really starting a witchhunt because a guy ships his JS code minified? Doesn't it seem ridiculous to you?

The fact that @christianbundy was able to point out the similarities between the two versions of the method _showHeader clearly shows that the minified version of the source code is in fact the source code.

It's not debatable, it's pretty well established. You're obligated to distribute the source you edit.

https://softwareengineering.stackexchange.com/questions/62885/must-source-code-released-under-gpl-be-human-readable

Directly from the AGPL:

The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work.

quannt · 2020-11-03T01:10:15Z

@reanimus Again, "the preferred form of the work for making modifications" is subjective, what's "preferred form" anyway, preferred by whom?

And then the story becomes

Are we really starting a witchhunt because a guy ships his JS code minified? Doesn't it seem ridiculous to you?

I'm all for open-sourcing and free software, but this is getting blown way out of proportion.

reanimus · 2020-11-03T01:16:22Z

@reanimus Again, "the preferred form of the work for making modifications" is subjective, what's "preferred form" anyway, preferred by whom?

And then the story becomes

Are we really starting a witchhunt because a guy ships his JS code minified? Doesn't it seem ridiculous to you?

I'm all for open-sourcing and free software, but this is getting blown way out of proportion.

With AGPLv1 you (might) have an argument, but not v3 (which is based on GPLv3).

From https://copyleft.org/guide/monolithic/

First, GPLv3 §1 retains GPLv2’s definition of “source code” and adds an explicit definition of “object code” as “any non-source version of a work”. Object code is not restricted to a narrow technical meaning and is understood broadly to include any form of the work other than the preferred form for making modifications to it. Object code therefore includes any kind of transformed version of source code, such as bytecode or minified Javascript. The definition of object code also ensures that licensees cannot escape their obligations under the GPL by resorting to shrouded source or obfuscated programming.

hyiltiz · 2020-11-03T03:20:06Z

I am astonished to see so many developers out there who just sticks a license file into their source directory without either reading the full license body (GPL is pretty readable and not one of those legalese) or even some dummy summary of the license somewhere (e.g. Github shows some bullet points).

For anyone who'd like to make up for this missing homework, at least read up parts of AGPL that mentions obfuscated, derivative and release.

christianbundy · 2020-11-03T04:13:27Z

For anyone who'd like to make up for this missing homework, at least read up parts of AGPL that mentions 'obfuscated', 'derivative' and 'release'.

Small nit-pick: I couldn't find any of those words in the AGPL 3.0. These are the closest definitions that I could find:

Obfuscated → Object code
Derivative → Modified version
Release → Propagate

EDIT: Oh, maybe you meant https://copyleft.org/guide/monolithic/?

buunguyen · 2020-11-04T19:58:17Z

Hi, everyone. Thanks for voicing your opinions. I've just posted this in the Octotree forum to clear up some misunderstandings and have a dialog with Octotree contributors. Octotree contributors and I will discuss to address any concern and see how we can keep Octotree continue being a useful tool.

hyiltiz · 2020-11-04T20:26:16Z

Cannot seem to be able to participate in that discussion in any way, because while you closed this issue [0], you also blocked me from your "organization". I am sure many others here also were "not invited to the party".

[0] ovity/octotree#1041

crashbell · 2020-11-04T20:37:23Z

@hyiltiz I think he made it clear:

Octotree contributors and I will discuss to address any concern and see how we can keep Octotree continue being a useful tool."

"blocked" seems to be a misleading word in this context. That thread would be a discussion between contributors and @buunguyen

christianbundy · 2020-11-04T21:11:35Z

@crashbell:

To be clear, I (and others who have tried asking questions) are blocked from Octotree repository and Ovity organization. That issue might be contributor-specific, but that doesn't mean that @buunguyen hasn't blocked us and deleted our comments.

@buunguyen:

I will spare you from most of the details but the last few days have been some of the worst days of my life.

It shouldn't have to be said, I'd like to condemn any harassment you've experienced. You should be obligated to fulfill the terms of your license agreement and face the consequences of censorship/etc, but that doesn't require name-calling or harassment.

I hope you can take some time to prioritize yourself and your family, and then I'd ask you to reconsider your stance on this issue. I think the right thing to do is follow the agreement and publish your closed-source fork under the AGPL.

When we wanted to reuse some legacy code, we reused those we believed were ours (or under MIT license) and rewrote others. It's worth noting that current and former Octotree team members (Buu Nguyen, NDQ/endyquang, Phi/nphi, Fahme, An/crashbell, Danh, duylam) own the vast majority of code in the open-source version. Coupled with the rewrite, it's unlikely AGPL code from non-team members exists without having been rewritten.

Again, I want to highlight that the "rewritten" code is still licensed under the AGPL if it was ever mixed with or derived from AGPL'd code. If your "rewrite" has any shared history with non-trivial AGPL code, it's a derivative. The point of the AGPL is to prevent closed-sourced forks like yours, and I'm disappointed that you're still trying to avoid the terms of the agreement that you have with contributors.

Copyleft is a viral, so any changes that touch AGPL code are bound under the AGPL themselves. Any changes to that code is bound under the AGPL, and so on. Unless you've been very careful to avoid touching any AGPL code anywhere, I'd imagine that most of your codebase has been 'contaminated' by the APGL -- which is exactly what the license is designed to do.

Again, I'd highlight that the best option is to share the source of your paid product under the AGPL, at least with people who download it (your don't have to put it on GitHub). This solves the problem, highlights that Octotree is committed to the principles of open source software, and [most importantly] is the right thing to do.

haiphucnguyen · 2020-11-05T03:06:35Z

@christianbundy

If your "rewrite" has any shared history with non-trivial AGPL code, it's a derivative

If you have time, please read the copyleft https://copyleft.org/guide/monolithic/#x1-300004 especially sections 6 and 7. I do think you misunderstand what is the derivative means. I can extract the source from the above link that does matter

Likewise, the similarity between the organizational charts of the two programs was not substantial enough to support a finding of infringement because they were too simple and obvious to contain any original expression.

To answer the problem if you replace a simple method add(int a, int b) with another method sum(int x, int y) does not support this case. I will claim @buunguyen violates the license if he just decorates his code for an advanced algorithm from a source code of the AGPL license.

@buunguyen also tried to solve any issue with the contributors of the project, which the license requires he needs to get the grant permission from contributors. Let them solve by themselves. From the license terms from the above official document, the claim of derivative for your sample is not convincible.

For your reference, you can read these threads and also read my above link

I'd like to say instead of claiming, and act as a magistrate. Let @buunguyen and his contributors do their jobs, and let them keep maintain and improve that good software to the community. Is that your main purpose?

christianbundy · 2020-11-05T03:32:57Z

Likewise, the similarity between the organizational charts of the two programs was not substantial enough to support a finding of infringement because they were too simple and obvious to contain any original expression.

What does this mean? Org charts? You're writing as if your opinion was backed by a court or something. I'm confused at both your tone and the content of your message.

@buunguyen also tried to solve any issue with the contributors of the project

No, they tried to claim that they weren't infringing and censored any discussion that provided contradicting evidence. They're now trying to avoid complying with the license agreement by asking for consent from contributors, but that's because they want to circumvent the agreement rather than follow it.

For your reference, you can read these threads and also read my above link

Did you read your links? It literally says "first, Google never 'forked Java' for Android", which is exactly what we're talking about here. @buunguyen forked a project that was published under the AGPL and is now refusing to comply with the terms of the AGPL because they think their derivative has enough changes that it's a "complete rewrite". That's not how derivatives work. Every time you make a change, your change is covered under the AGPL. If they want to have a closed-source project then they need to do what Google did: create a clean-room implementation with similar behavior and zero shared provenance.

haiphucnguyen · 2020-11-05T06:40:46Z

They're now trying to avoid complying with the license agreement by asking for consent from contributors

Huh? Where do they say that in their post? Show me.

No, they tried to claim that they weren't infringing and censored any discussion that provided contradicting evidence.

Their post explains the reason your comments were deleted.
And infringement how? Did you read the part they said they did rewrite and willing to let Octotree contributors look at their code to prove it? Did we read the same post or what? I talk about this post

I see a pattern here @christianbundy, you make some guess then talk about it like it is fact. You are like that from the beginning when you insisted they use code on master with little changes and now you insisted they avoid complying, they infringe, they try to get around compliance, must do clean room blah blah.

Someone here said earlier you didn't act in good faith. I now see that is exactly true. You posted here, you posted on hacker news, you tagged a lot of people, keep add flame to the thread, ignore constructive comments from other people. Why are you working so hard to cancel this guy? Because he hurt your feeling by deleting your comments? Because you didn't get the source code you wanted?

christianbundy · 2020-11-05T07:19:58Z

Please answer my questions before throwing a barrage of questions at me. I'm trying to be polite so I'll answer, but I'm really not interested in hashing this out repeatedly with drive-by commenters.

Huh? Where do they say that in their post? Show me.

Please read the thread. Remember to click 'show 55 hidden comments' because GitHub truncates long discussions. I've repeatedly clarified that claiming "rewrite" doesn't solve the problem, so they want to ask contributors to give up their rights and re-assign the license: #1 (comment)

Their post explains the reason your comments were deleted.

Yes, exactly: "Had I responded to that instead of throwing a tantrum, this whole ordeal probably wouldn't have happened."

And infringement how?

Read the AGPL.

Did you read the part they said they did rewrite and willing to let Octotree contributors look at their code to prove it?

Yes, I've taken the liberty to read the subject we're discussing. I would respectfully request that you do the same. I've already proven that there's AGPL code in their fork, which they've admitted to, and an offer to see more infringement after signing an NDA really doesn't contradict that evidence.

My best guess is that they're usually nice people who actually just misunderstand how the AGPL works. They probably think that their fork is fine because they've made lots of improvements to the point that it's hard to recognize the infringement. The problem is that the point of the AGPL is to capture these types of improvements and prevent a closed-source fork. I've tried to talk this over with them repeatedly, but when you bring up the facts they delete your comments and accuse you of spam or trolling.

You are like that from the beginning when you insisted they use code on master with little changes and now you insisted they avoid complying, they infringe, they try to get around compliance, must do clean room blah blah.

Yes, this is called "staying on-topic". It's not as fun as the alternative, but it's generally preferred when facts and evidence are on your side.

If you'd like to contribute something useful to this thread, feel free, but I won't be replying to any more drive-by comments from folks who can't be bothered to read the discussion they're commenting on.

haiphucnguyen · 2020-11-05T07:28:16Z

Updated: another thing @christianbundy, stop making the demand. Let the actual contributors speak their own mind [1][2][3]

1: ovity/octotree#1046
2: #1 (comment)
3: #1 (comment)

christianbundy · 2020-11-05T16:35:26Z

@haiphucnguyen

I asked you to please actually read the thread and your response is now "shut up". Cool.

Look, if you don't want to hear what I have to say I'd recommend spending more time in the Octotree repo, where I'm banned. It's unbelievably silly to join a conversation that I started and then complain that I'm part of the discussion. Also, you're doing the exact thing that you're arguing against: advocating for other people. It's just that we're advocating for different people for different reasons:

Me -- Octotree should not violate the rights of its contributors, because they agreed to the AGPL.
You -- Nobody should talk about the rights of contributors or how Octotree is violating them, because ???.

It's clear that you only want a one-way conversation where you can avoid reading or addressing the points that other people make. I'd like to respectfully challenge you to do better in conversations with other people, but my personal budget for this kind of behavior is spent. I won't be replying to any similar comments. Cheers.

haiphucnguyen · 2020-11-05T18:19:09Z

@christianbundy

Me -- Octotree should not violate the rights of its contributors, because they agreed to the AGPL.
You -- Nobody should talk about the rights of contributors or how Octotree is violating them, because ???.

This is an example of a one-way conversation when you assume my reasons without reading carefully my point. I don't want to waste my energy to argue because every new conversation, you lead people to go in a new direction. I sympathize with @buunguyen because just like him I have my own paid job, and working on open source is a hobby. I iterate my points from the first post.

You claim @buunguyen to violate the AGPL rule here, and according to me, it is not convinced if you read this post about the copyleft. I read your comments about the derivative but please interpret the derivative from the legal terms not the word of mouth or you assume that it is. If you can find another example that @buunguyen and his team get from the AGPL code a complex function or a complex algorithm (like I stated clearly in my post) then I am at your side.

The similar of such a simple API (and I don't spend time to verify whether @buunguyen get from AGPL code), and I give you a discussion of other voices when we talk about the derivative. So I don't think your example convince me @buunguyen violates the AGPL terms. I respect you have different ideas, but I hope you get my points precisely. It is Octotree does not violate the rights of its contributors

You or anyone have the right to talk to the rights of contributors, and I also have that right. @buunguyen stated that contributors can review his commercial code, and clarify whether he gets their codes. Octotree product belongs to the right of its contributors, who wrote the codes and they know the Octotree architect, codebase so if they assess whether @buunguyen do the derivative works make more sense to me. I did write a project that lasts 6-7 years with a very long history, I am going to look into the real code, review the code carefully to detect any infringement, not only a simple API. From my perspective, the contributors have more knowledge about the Octotree to give their assessment rather than give an output of simple API and claim the entire product. Does it make sense?

You can fight the right to contributors and the open-source community if you think so, but I do believe in who understands the Octotree architect, API, and worked with @buunguyen and evaluate whether @buunguyen steal their works. If you have the skills to review the code that you are not familiar with, then you can review the code because they are javascript and prove whether they use the same architect just changes a little bit from API, naming conventions, etc then again I am on your side. What you claim them about derivative or clean-room does not make sense to me, and I wonder who agree with you about the AGPL actually read the AGPL terms, or know the difference between the MIT, BSD, and Apache v2, that means some of the open-source licenses without searching Google. If @buunguyen has the intention to make a commercial in Octotree, the license he should choose is Apache v2 (not MIT originally then AGPL). So when I read the Octotree license history, I sympathize with him and I do believe he just had a plan to commercialize the product recently to keep the product alive because he is busy with his current job.

I am using the Octotree free edition, and I don't have a plan to pay their team. I don't think they can earn money more than their time and effort. When they don't violate the AGPL (until you give more convincible evidence), let encourage and help them if you think they make mistake (per your opinion). That toxic action just kills the emotion of people when they want to contribute to the open-source community.

I will be back if you give clearer evidence of how @buunguyen got the AGPL code, with the arguments against the terms here https://copyleft.org/guide/monolithic/#x1-300004. I will be on your side if you do so. Otherwise, I mute from now because I don't want to talk to the wall if we don't have the same page on legal terms, an open and constructive mindset. Thanks and bye-bye.

haiphucnguyen · 2020-11-05T19:05:53Z

@christianbundy

I give you some more examples. Regarding the derivative or claiming, @buunguyen got the AGPL code, and you didn't understand my original point well:

I write a simple Hello world program, and I license my code is AGPL (I am the first people to grant a hello world program the GPL license). You click and view my program, so from now on please not write any Hello world program because you get my idea. Does it make sense?
If you want to replace a simple method sum(a,b) because it belongs to the GPL code, then do you rewrite this method to

public int sumTwoNumbers(int a, int b) {
    int c = a - b;
    int d = c + b;
    return d + b; // to return the a + b
}

Do you think people claim this code is appropriate?

If you found me to get the algorithm to encode the video in h264 format from ffmpeg (which has GPL license), even I change the number of parameters but the ideas of the encoding byte stream the same as the original code. If I am an experienced engineer then I can do so, so do I violate the GPL license?

According to me, in example 3 I violate the GPL license, and experience expert engineers can assess that I violate the GPL license. Hope that helps

13rac1 · 2020-11-05T23:15:43Z

Trying to avoid wading into the rest of this as I am not a Octotree contributor, but care deeply about licensing and the GPL. I write libraries and applications with GPL, AGPL, MIT, or Apache licensing depending on use case. I hope to clarify the licensing questions.

I wonder who agree with you about the AGPL actually read the AGPL terms, or know the difference between the MIT, BSD, and Apache v2, that means some of the open-source licenses without searching Google

I have read these licenses. I know the differences without a Google search. You violate the AGPL/GPL license if you copy a single line of code into a closed source or MIT/BSD/Apache licensed application. It is best to not look at GPL/AGPL/LGPL code if you are writing a closed source application.

I write a simple Hello world program, and I license my code is AGPL (I am the first people to grant a hello world program the GPL license). You click and view my program, so from now on please not write any Hello world program because you get my idea. Does it make sense?

Only the code is covered under the GPL/AGPL. It is only a license violation if I copy the code. Your license does not cover every application which outputs the text Hello World.

If you want to replace a simple method sum(a,b) because it belongs to the GPL code, then do you rewrite this method to [code] Do you think people claim this code is appropriate?

It is already too late if you are in this situation. Do not look at the GPL code. See https://en.wikipedia.org/wiki/Clean_room_design

If you found me to get the algorithm to encode the video in h264 format from ffmpeg (which has GPL license), even I change the number of parameters but the ideas of the encoding byte stream the same as the original code. If I am an experienced engineer then I can do so, so do I violate the GPL license?

Yes, it is a GPL violation. Don't do it.

hyiltiz · 2020-11-14T06:36:23Z

For anyone interested, here is a AGPL compliant fork: https://github.com/treepanel/treepanel

buunguyen mentioned this issue Nov 4, 2020

Octotree and AGPL ovity/octotree#1046

Closed

danhgit mentioned this issue Mar 30, 2021

Octotree did NOT violate the AGPL. Period. ovity/octotree#1068

Closed

Octotree censorship / AGPL violation #1

Octotree censorship / AGPL violation #1

Comments

christianbundy commented Oct 31, 2020 • edited

Thread summary

TL;DR

Example

AGPL

Proprietary "complete rewrite"

christianbundy commented Oct 31, 2020 • edited

christianbundy commented Oct 31, 2020 • edited

zacanger commented Oct 31, 2020

Lattyware commented Oct 31, 2020 • edited

christianbundy commented Oct 31, 2020

christianbundy commented Oct 31, 2020

Fahme commented Oct 31, 2020

buunguyen commented Oct 31, 2020

tbodt commented Oct 31, 2020

judge2020 commented Oct 31, 2020

christianbundy commented Oct 31, 2020

Lattyware commented Oct 31, 2020 • edited

buunguyen commented Oct 31, 2020 • edited

Lattyware commented Oct 31, 2020 • edited

hyiltiz commented Oct 31, 2020 • edited

christianbundy commented Oct 31, 2020

buunguyen commented Oct 31, 2020

christianbundy commented Oct 31, 2020 • edited

buunguyen commented Oct 31, 2020

buunguyen commented Oct 31, 2020

christianbundy commented Oct 31, 2020

Lattyware commented Oct 31, 2020 • edited

buunguyen commented Oct 31, 2020

morotti commented Oct 31, 2020 • edited

hyiltiz commented Oct 31, 2020 • edited

zacanger commented Oct 31, 2020

hyiltiz commented Oct 31, 2020 • edited

buunguyen commented Oct 31, 2020

ddevault commented Oct 31, 2020

buunguyen commented Oct 31, 2020

christianbundy commented Nov 2, 2020

Lattyware commented Nov 2, 2020 • edited

ddevault commented Nov 2, 2020

christianbundy commented Nov 2, 2020 • edited

max-hk commented Nov 2, 2020 • edited

quannt commented Nov 3, 2020

judge2020 commented Nov 3, 2020

reanimus commented Nov 3, 2020 • edited

quannt commented Nov 3, 2020

reanimus commented Nov 3, 2020 • edited

quannt commented Nov 3, 2020

reanimus commented Nov 3, 2020 • edited

hyiltiz commented Nov 3, 2020

christianbundy commented Nov 3, 2020 • edited

buunguyen commented Nov 4, 2020

hyiltiz commented Nov 4, 2020

crashbell commented Nov 4, 2020

christianbundy commented Nov 4, 2020

haiphucnguyen commented Nov 5, 2020 • edited

christianbundy commented Nov 5, 2020

haiphucnguyen commented Nov 5, 2020

christianbundy commented Nov 5, 2020

haiphucnguyen commented Nov 5, 2020

christianbundy commented Nov 5, 2020

haiphucnguyen commented Nov 5, 2020 • edited

haiphucnguyen commented Nov 5, 2020

13rac1 commented Nov 5, 2020

hyiltiz commented Nov 14, 2020

christianbundy commented Oct 31, 2020 •

edited

christianbundy commented Oct 31, 2020 •

edited

christianbundy commented Oct 31, 2020 •

edited

Lattyware commented Oct 31, 2020 •

edited

Lattyware commented Oct 31, 2020 •

edited

buunguyen commented Oct 31, 2020 •

edited

Lattyware commented Oct 31, 2020 •

edited

hyiltiz commented Oct 31, 2020 •

edited

christianbundy commented Oct 31, 2020 •

edited

Lattyware commented Oct 31, 2020 •

edited

morotti commented Oct 31, 2020 •

edited

hyiltiz commented Oct 31, 2020 •

edited

hyiltiz commented Oct 31, 2020 •

edited

Lattyware commented Nov 2, 2020 •

edited

christianbundy commented Nov 2, 2020 •

edited

max-hk commented Nov 2, 2020 •

edited

reanimus commented Nov 3, 2020 •

edited

reanimus commented Nov 3, 2020 •

edited

reanimus commented Nov 3, 2020 •

edited

christianbundy commented Nov 3, 2020 •

edited

haiphucnguyen commented Nov 5, 2020 •

edited

haiphucnguyen commented Nov 5, 2020 •

edited