|
...and I didn't even get to deliver the final kick 
|
|
|
|
|
First of all, please don't act against the person who performed the violation, I already talked to him, asked to remove the copy and just want some advice.
The violation can be considered as unwilling, but…
I recently published this game in my article, which is the pure HTML+JavaScript product, ready-to-play: Tetris on Canvas[^].
CodeProject does not allow publishing HTML and Javascript source directly, requires to pack it all in the source code file, so the game can be played only if it is unpacked. But apparently, if the sources are put on some Web site, the game will become immediately playable. This is what this member did:
http://www.codeproject.com/script/Membership/View.aspx?mid=2126810[^],
here: Tetris on Canvas[^].
Is it acceptable or not? To me, it was a somewhat unpleasant surprise that this person did not even talk to me about it, just created a copy and provided a link.
But the license itself allows free re-distribution. Formally, the violation is different: the license, more exactly, its permission statement has became inaccessible to the user, because of the direct access only to one HTML file housing the game. I explained why this is the violation in my reply where I asked to remove the copy: Tetris on Canvas[^].
I think the violation problem is clear enough. I've chosen MIT licensed because my work is the derived one; it was the decision of the author of most basic algorithms and the code I used just as the prototype; I provided complete attribution of this work and its author in my derived work. Apparently, this is enough reason for me to derive my license text from the original license. Also, I would like to keep this CodeProject article as the only original source of this code, which would be important, in particular, for updating the game to some possible newer versions.
My idea is to alleviate the future possible cases of such uncontrolled distributions by, say, adding appropriate references to the help element of my HTML. Then the link to the license, the CodeProject source and authors' attribution, invisible at first, still will be accessible to the users after clicking on help. But I certainly need removal of the copy from the site when this information is not accessible.
Any other suggestions? And how such incorrect re-distributions and the members doing such things should be treated?
Thank you.
—SASergey A Kryukov
|
|
|
|
|
Your timing is awesome. I was up till the wee hours this morning writing up a position paper on proposed changed to the CPOL and have been discussing exactly the issues you raise.
First: We're more than happy to post live javascript in your article. It will mean you won't be able to update it directly, but it would make for an interesting article.
Second (your concerns).
1. The MIT license does allow him to use the code as as long as he abides by the bit "The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.". As you know he's not done this, and hence yes, he's in violation.
2. "keep this CodeProject article as the only original source". This was one of the main motivations for creating the CPOL. We specifically included wording to address both the code and the article to ensure authors have control and only have to manage a single source for their work.
To prevent redistribution issues you could simply add text in the game itself that includes a copyright and redistribution (MIT license) notice with link back to your CodeProject article. This won't stop people stripping it out, but at that point it becomes a common or garden plagiarism issue.
cheers
Chris Maunder
|
|
|
|
|
Chris,
Thank you very much for your suggestions. It looks like we are getting a well-balanced approach to related problems.
Now, as to your suggestion on adding appropriate text "in the game itself", I already made very similar steps and plan to complete my modifications shortly. Essentially, the only difference between having the license permission note in the zipped source files in the article and "in the game" is the access to this information when the game is published as a separate Web page. I think putting the license and copyright links to my short help block would be quite enough as it is close to the common practice putting it on the Help -> About box and would be well expected by those who are interested in this information.
When this is ready, I'll update the article and the zip.
As to your suggestion to have a live game on the page of the article, I don't mind, it's a good idea, and it can really add intrigue to the article. 
I also don't mind if I won't have access to these files (safety first, as I understand it), but in the case I decide to improve the game, we would need to communicate to sync the life copy with the zipped copy. What it takes is really making a copy: the source files (after my changes) need just to be unpacked somewhere, as is, so main HTML file "index.html" can be referenced by an anchor in the article HTML. That's all.
After I'll complete the changes, I'll notify you again. If we continue with the "life copy" of the game on this site, please tell me my further steps.
Thank you.
—SASergey A Kryukov
modified 19-Feb-15 2:19am.
|
|
|
|
|
Sergey Alexandrovich Kryukov wrote: but in the case I decide to improve the game, we would need to communicate to sync the life copy with the zipped copy
Sean is always on standby and can get updates made quickly.
We'd love to have a live version!
cheers
Chris Maunder
|
|
|
|
|
Great. Give me a bit of time. I'll reply when I'm ready.
—SASergey A Kryukov
|
|
|
|
|
Chris,
Thank you for your effort. There are some issues, I fixed some (capitalization, TOC and section anchors), but screwed up the iframe itself. On update, it keeps escaping HTML markup. I already faced this problem before, did not have time to clearly reproduce to report it. Besides, if you paste full HTML in the article edit control, the problem did not appear.
At this moment, I have no time to continue, so I put "under construction" words for now. Sorry.
Now (sight…) I was afraid you would do something like this. Unfortunately, there is some frustration. Putting the game in the iframe makes it not fully functional (I did not test everything, did not test help). But this is not the point. The point is real user experience. To me, the game does not look quite playable. My main point was to resize the game on page resize, which is a delicate thing. Even on my laptop, not too small at all, the game is too big to fit. On my big monitors, it should be fine. I tell you: on very many computers, the life preview won't be playable.
As a temporary measure, I tried to make it twice as small. I renamed to section to "Live Preview" and was about to add text to it. But I'm not even sure that it will be acceptable.
I understand if you wanted to always keep the game in the background showing all CodeProject environment. But it cannot prevent others from playing the game on a separate page, even if they copy all the code (this time, it would not violate the license, so nothing can stop them). Here are the options we have:
1) Remove life preview at all; this is still a viable option which was there in first place.
2) Leave it as is, but reduce the size and add some notes on resizing.
3) Create the edition of the game in a fully-functional way: resizeable; In this case, it should be on a separate page, but in a special edition showing CodeProject environment you define. It would need more effort.
4) Just publish it on a separate page as is; but I will understand if you consider it not acceptable.
5) Something between 3 and 4; having very limited CodeProject design features and requisites, with back link to article immediately on the game page.
What do you think?
—SASergey A Kryukov
|
|
|
|
|
Sergey Alexandrovich Kryukov wrote: On update, it keeps escaping HTML markup
This is precisely why I said we'd have to do updates after we made the code go live.
I set the width of the frame to be 700px but I could easily just set it as 100% and so when users are in fluid view and they resize then they'd see the canvas resize as the iframe resized.
cheers
Chris Maunder
|
|
|
|
|
Thank you, Chris.
All right, please hold on, I'm thinking of something to improve the life play. But to restore what you already did, please tell me that URL (something "~/.../KB.../index.html")? — I accidentally lost it, sorry.
Also, could it be done directory-like (through default/index file of directory), to avoid showing "index.html" part?
—SASergey A Kryukov
|
|
|
|
|
Try it now. (Ensure you try it in fluid layout, too: Tetris on Canvas[^])
cheers
Chris Maunder
|
|
|
|
|
Now it shows: "403 - Forbidden: Access is denied". Something's wrong with the URL.
And, after I tried to reproduce it — empty content...
Wait a minute, I found a bit more elegant solution with resize. You wrap iframe in resizeable div with certain style. I just need to figure out good initial size and sort out some problem with scroll bars. Still a bit limited show, but already much better... Then we can get back and restore the live play...
—SA
Sergey A Kryukov
modified 20-Feb-15 17:07pm.
|
|
|
|
|
Sergey: You can't edit it yourself. You simply do not have the permissions necessary to include script and iFrames.
Please let us do the editing 
cheers
Chris Maunder
|
|
|
|
|
Ah, iframes, too? I see...
Please see my other message entitled "New HTML markup for iframe, cannot submit it" where I copied somewhat improved iframe markup. But iframe src URL doesn't work. Please put it together, will you?
—SASergey A Kryukov
|
|
|
|
|
Chris,
Please see what I got:
<div style="resize:both; width: 635px; height:525px; margin: 0; padding: 0; overflow: hidden; border:0; frameborder: 0; "><iframe src="/kb/game/876475/" style="margin: 0; padding: 0; overflow: hidden; border:0; frameborder: 0; width:100%; height:100%;"></iframe></div>
Can you see the idea? Resizeable div wraps 100%-sized iframe. Still, it's not perfect; I cannot resize to smaller size without showing a scroll bar; and Chrome does not show the resize grip. Still, it looks better.
Unfortunately, I cannot enter this markup to the article anymore; on submission, the HTML characters got automatically escaped. Could you fix it? And remember, src URL does not work anymore, also should be fixed.
—SASergey A Kryukov
|
|
|
|
|
Chris,
Oh, now it works. Much better. I think we can leave it as it is right now, at least until I have something to improve in the game itself.
Thank you very much for all your help and enthusiasm about this thing.
—SASergey A Kryukov
|
|
|
|
|
Excellent.
Be sure to go through us for all updates. We're doing something behind the system's back, and it gets very snappy when we try and be sneaky and tends to delete first and ask questions later if it smells something fishy.
cheers
Chris Maunder
|
|
|
|
|
I know what you are talking about, we will do it.
Thank you again.
—SASergey A Kryukov
|
|
|
|
|
Chris Maunder wrote: We're more than happy to post live javascript in your article.
It would probably make sense to host the user-provided code in a sandboxed iframe, and serve it up from a different domain, just in case anything slips through.
Also, if possible, it should run on demand rather than when the page loads.
I know it's a dirty word around here, but StackOverflow's implementation is quite nice:
http://blog.stackoverflow.com/2014/09/introducing-runnable-javascript-css-and-html-code-snippets/[^]
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
That's a slick implementation but I worry that it still opens up security issues. "Run code snippet" is a very inviting button to press, and for the uninitiated it could lead to trouble.
SO's community moderation is extremely tight, though, so damage would be short lived due to the snippet being closed down quickly.
And no, Stackoverflow isn't a dirty word. They just do things different.
cheers
Chris Maunder
|
|
|
|
|
Keeping the script in a sandboxed iframe served from a separate domain would at least prevent a malicious script from stealing any cookies, or forging requests to the site from my login.
I know the plan is to have the hamsters vet the script before it makes it onto the site, but they might not catch everything.
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
Guys, you can simply inspect the code, honestly, very clear and pretty short, and see that it does not do anything except accessing the browser's screen. Not using DirectX is already a big safety measure.
Chris, you told me that I won't have any access to the published resources (I guess, first of all, because there is no such public mechanism), so what's the problem?
Just for a record, that was not me who put forward the idea of having the life game published as well.
Thank you.
—SA
Sergey A Kryukov
|
|
|
|
|
I wasn't suggesting that your code would be malicious.
My concern is that, if it becomes commonplace to have user-supplied javascript running within an article, there will inevitably be some toerag who manages to slip malicious code past the hamsters. It's better to take steps to limit the potential damage now, rather than after the event.
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
Sure, I know that. Please see my other comments.
—SASergey A Kryukov
|
|
|
|
|
That's a good point. The key is the possible scale or severity of the disaster and some sanity. In such a technology as JavaScript, designed for safety if first place (until it was completely spoiled with something like ActiveX component embedding), human-driven moderation can be reliable enough.
But I understand that you probably discuss the possibility of allowing publishing of JavaScript by default, as a potentially massive act performed by any user. Here I would be much more careful and doubtful. Imagine that the destructive attack is found and performed massively and on purpose. Then even the fully reversible and limited damage can present a problem. Don't forget that trivial but massive spamming attack partially paralyzed work for a while, just because real questions were not easy to spot.
—SASergey A Kryukov
|
|
|
|
|
Looks like an interesting technique anyway. Thank you for sharing.
—SASergey A Kryukov
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
