Unless I’m mistaken every curated app on AppCenter is currently violating GitHub’s trademark (RDNN)

[aral]

I just finished the developer tutorial and I initially thought that the app IDs starting with com.github were for the sake of the examples but after reading https://docs.elementary.io/develop/appcenter/publishing-updates, I checked flatpak list and, lo and behold, it does seem all third-party apps on elementary OS have to have an app ID starting with com.github.

This is a big problem.

It‘s a trademark violation.

None of those apps are by GitHub and yet they have bundle identifiers that include GitHub’s trademark and use its domain in reverse as a unique namespace.

GitHub has gone on the record in the past to explicitly disallow this very use case:

"Unfortunately, we can't allow you to use io.github in your package name. Use of GitHub in a package name could imply affiliation, sponsorship, or endorsement on GitHub's behalf. Therefore, in order to prevent user confusion, we only allow official GitHub packages to be released using GitHub in the package name. I'm very sorry for the disappointment."

(https://law.stackexchange.com/a/38756)

I feel really horrible bringing this up now (and not earlier) but I only just became aware of it. I have a really bad feeling that this is not going to be easy to change but the sooner it’s addressed, the better. You do not want to base a core piece of functionality in your OS on something that forces application developers to violate the trademark of a trillion-dollar corporation.

Not knowing enough about the internals, I cannot really propose a best way forward and hence this discussion thread, but is there any technical reason why the app ID has to reflect the GitHub repository? I understand that AppCenter has to know what the GitHub repository is but I’m assuming that could easily be included as a bit of metadata in the app.

Thoughts?

[kgrubb]

I am not a lawyer.

According to that same stack exchange question, one of the replies also noted:

As described in the question, "GitHub" is not used in advertising the OP's app, and nothing described could reasonably confuse anyone into believing that the App was by GitHub, nor that it was endorsed, approved, or sponsored by GitHub, or that the OP was associated with GitHub beyond having an account on GitHub. If that remains true when looking at the details, there does not seem to be a trademark problem, although a disclaimer such as "Git Hub is a trademark of {entity}. GitHub has not endorsed or approved {Thisapp} in any way." would be a good idea.

I don't think this constitutes as impersonation, endorsement, or name dilution, thus making it acceptable. This same format is actively used by many maven repositories for example, without issue. Of course, I could definitely be wrong as well. The line doesn't seem to be very explicit from my quick internet searching...

[aral]

CC @danrabbit @cassidyjames

[cassidyjames]

I am also not a lawyer, but can reach out to a contact at GitHub for clarification.

I will say, the reply to a random email pasted on to StackExchange seems like a CYA from someone on GitHub's side that has no legal precedent; if my website is hosted at cassidyjames.github.io, then me including a link to that URL does not imply endorsement, approval, or sponsorship of GitHub—it's simply where it is hosted and linking to it is performing the technical bits necessary to point the user's browser to that URL. I would like to hear GitHub challenge everyone ever pointing a link to GitHub for violating copyrights. 😉 Similarly, RDNN by its nature points to where the app is hosted, which currently for AppCenter is on GitHub repos (but theoretically in the future could be anywhere else). This is a technical implementation detail, is never exposed as a human-readable app name, and is used to make technical guarantees about the origin of a package.

[elsiehupp]

Disclaimer: I am not a lawyer.

My take is that because io.github.[username] is literally a domain, if GitHub seriously didn’t want people using it then they wouldn’t have created [username].github.io user domains in the first place. As far as trademarks go, linking to a (sub-)domain created by the domain holder who is also the trademark holder is what one would call “nominative use”, which is an explicit exemption under US trademark law.

One of the landmark court decisions creating the precedent for nominative use is Playboy Enterprises, Inc. v. Welles, where it was determined that a person who had been designated a “Playboy Playmate of the Year” by the holder of the “Playboy Playmate of the Year” trademark (i.e. Playboy Magazine) had a legal right to refer to this fact in their website’s metadata. Referring to a URL authorized by a trademark holder is about as close to a textbook example of this sort of nominative use.

The court specifically enumerated a requirement that nominative use may not imply endorsement, and indeed Flathub’s guidelines explicitly distinguish between com.GitHub.[application_name] and io.GitHub.[username].[application_name] as the former being exclusively for applications developed by and distributed by GitHub, e.g. GitHub Desktop, Atom, or Electron (though Atom has its own domain, as does Electron), and the latter being for applications distributed from that GitHub username. If push came to shove, a court could plausibly find that the com.GitHub.[username].[application_name] constituted nominative use, as well, but the guideline establishing io.GitHub.[username].[application_name] acts as an explicit disavowal of endorsement.

Third-party distribution is a bit messier. My understanding is that as long as an application is substantially unmodified, US Trademark law provides an explicit nominative use right for referring to that application by its trademarked name. If, however, an application is substantially modified, a trademark holder may ask the distributor of the modified application to cease and desist from using the trademark (if the license does not provide explicit permission to do so). So basically if you make a fork and maintain it separately from the original, you should give your fork a distinct name, though of course you can (and the license may require your to) refer to the fact that your fork is derived from the other application, with this reference covered as nominative use.

Fair Use under US trademark law is somewhat different from Fair Use under US copyright law, and this can be a source of confusion. And, it’s important to note, Microsoft is arguably legally domiciled in the US State of Washington (though it’s probably incorporated in Delaware like most US corporations), while Microsoft’s GitHub subsidiary is arguably legally domiciled in the US State of California, so by all accounts GitHub’s US trademarks would be legally subject to US copyright law. While in some cases trademarks are not internationally reciprocal to the same extent as copyrights, a situation where a US-based corporation would be under an incompatible trademark jurisdiction is its own can of worms. Nonetheless, the only other plausible jurisdiction would be the legal domicile of Elementary’s (or Flathub’s or Fedora's) parent corporate entities, which IIRC are all also the United States.

For what it’s worth, though, I would be shocked if Flathub didn’t consult a lawyer when they came up with their RDNN guidelines, so tl;dr whoever answered the question on StackExchange claiming trademark infringement is probably full of shit and has no idea what they’re talking about.

[aral]

Flathub didn’t come up with guidelines suggesting use of com.github RDNNs, elementary OS did. (And Dan or Cassidy can correct me if I’m wrong but I don’t believe they consulted with a lawyer beforehand.)

Regardless:

• Even if Microsoft today doesn’t mind, pursue legal action, Microsoft tomorrow might.
• It gives Microsoft veto rights over what apps are allowed on elementary OS (only those approved for hosting on GitHub).
• An app’s RDNN is part of its brand. Independent developers and those who specifically use an OS like elementary because they don’t like Big Tech (or they’d use macOS) – the kind of folks elementary OS should be attracting – would probably be the last ones who want GitHub tied intimately and inextricably to the name of their apps.

All that said, it’s been mentioned elsewhere that this is not a hard requirement so I’m looking forward to some clarification and hopefully documentation on this.

[elsiehupp]

Flathub didn’t come up with guidelines suggesting use of com.github RDNNs, elementary OS did.

Flathub specifically reserves com.github for GitHub-branded applications, while third-party packages hosted on GitHub are required to use io.github. If Elementary OS uses com.github for third-party Flatpak packages, that seems like a huge compatibility mess waiting to happen.

Even if Microsoft today doesn’t mind, pursue legal action, Microsoft tomorrow might.

Yes, Microsoft may sue you at any time for any reason. Suing someone for clearly nominative use of a trademark seems like something that wouldn’t realistically happen, though. Generally if somebody’s going to sue you for trademark infringement or something like that, they will first send you a cease-and-desist letter, so you generally have the ability to remedy the abuse first in order to avoid being sued. And in the case of a clearly frivolous lawsuit, someone like the EFF would probably have an opinion on the matter.

It gives Microsoft veto rights over what apps are allowed on elementary OS (only those approved for hosting on GitHub).

If Elementary were to use the same guidelines as Flathub, this would not be a problem. I seem to have initially overlooked the fact that Elementary does not use the same guidelines as Flathub, which seems likely to cause any number of other problems.

An app’s RDNN is part of its brand. Independent developers and those who specifically use an OS like elementary because they don’t like Big Tech (or they’d use macOS) – the kind of folks elementary OS should be attracting – would probably be the last ones who want GitHub tied intimately and inextricably to the name of their apps.

Again, if we’re talking Flathub’s guidelines, then anyone who doesn’t like GitHub can instead use any domain they directly control. The GitHub Pages and GitLab Pages RDNNs are just fallback choices for developers who don’t feel like bothering with registering a domain if they don’t already have one. This is to say that GitHub Pages and GitLab Pages are basically just like any other vertically integrated hosting service, like Geocities or Wix. Not controlling your own domain is less than desirable, but using a vertically integrated hosting service takes a lot less work generally costs nothing. It is a strategic decision that some people make, and if Elementary doesn’t want to allow either of them as a fallback it could provide a fallback of its own.

If indeed Elementary uses com.github as the prefix for curated packages, regardless of trademarks that seems like a strange decision given the fact that Elementary has its own domain and consequently could use io.elementary instead. If the reason for not doing so is avoiding diluting Elementary’s own brand, Elementary could either use a subdomain RDNN along the lines of io.elementary.curated or it could just register a separate domain specifically for the purpose of representing its curated apps and then use that as the basis for the RDNN. Unfortunately, someone other than Elementary already seems to have registered appcenter.io. Maybe they should have picked a name with a domain they could register and registered it when they initially named this app? idk

tl;dr

I initially misunderstood the issue and thought that Elementary was using the same RDNN guidelines as Flathub.

While I can see a number of problems with using com.github as the basis for third-party RDNNs:

• the simplest solution is probably just to use the same guidelines as Flathub, and
• I got 99 problems, but trademark infringement ain’t one.