|
Something that I have been doing for years is actually reading licenses for software that I use and that companies use. This goes all the way back to when books were the only real source for code.
I have never worked with anyone else that does this. Even met a few people that seemed to think it was a waste of time.
Yet I do occasionally find problems with the code that is being used.
My perception over the last 10 years is that it has really gotten out of hand because people start importing libraries that in total might encompass hundreds of other libraries.
And then something like the following comes along that makes it much more relevant to understand that a library that seems like a good idea to include might require actually paying someone for it.
The Commons Clause will destroy open source | Drew DeVault’s Blog[^]
Note that the article above does not call out that this new license does not restrict it to just products but also services.
|
|
|
|
|
It's just such a hugely complicated topic...
Some of those licenses are pages long legalese that takes years of experience to understand.
I do try to figure out if some library is ok for me to use, so recently I came across some GNU license.
Here's the problem, GNU, as I understand it, is free for all to use for whatever they want (so what are the differences with MIT?).
However, my license wasn't GNU, it was GNUx (whatever x was), meaning that I should put a disclaimer with my software and source code.
The program I was working on was a closed source back-end service that no one would ever see.
Do I still need to put the license with it, where should I put it, can I use it at all?
If only it ended there.
The GNUx license was for the "free" version if the software.
I could buy a software license which would give me full rights to use the software, however, I wanted without the need for a disclaimer, but why would I because, as I said, no one would see the disclaimer anyway.
But wait, the license seemed to be necessary for any commercial product, but then what happened to GNUx which only required me to add a disclaimer?
Some parts of the library were GNU, others GNUx, then there are different versions of GNU and there's also GNUy and GNUz.
And what about software without licenses!
And next to licenses there are copyrights, which is restricted by law even if an individual doesn't agree.
Now I had to deal with a single library, but if you deal with multiple libraries and all those libraries reference a thousand other libraries you can only hope you're not breaking some kind of license/copyright law.
Meanwhile, my boss wants the code shipped by the end of the week.
In the end, I found some MIT licensed alternative.
As I understand it MIT is always completely free with all rights as if you wrote the code yourself.
But what if I didn't?
Who's ever going to find out my closed source back-end API is using some library with proprietary code? 
My guess is no one unless the library has some code that checks for licenses (which you can even remove if it's not compiled).
So yeah, I can see how people just don't want to go through all that hassle and can then say "we think it's ok to use this software, but we should hire a lawyer to make sure."
|
|
|
|
|
Sander Rossel wrote: Do I still need to put the license with it, where should I put it, can I use it at all?
Based on what you described - no.
The addition of the license is when you distribute the code. So if you decided to sell your server rather than just provide a service from it then you would need to include it as part of that sale.
Sander Rossel wrote:
And what about software without licenses!
Simple - don't use them. They are usually covered by copyright. So you must negotiate with the author always.
You can ask however and they might agree that you can use it any way you want. If that happens you MUST keep what the author sent you. I usually just check it into the source as a file with a note that explains it.
Sander Rossel wrote: Who's ever going to find out my closed source back-end API is using some library with proprietary code?
The scenario is as follows.
- You get sued (civil case) because it was decided that you were violating a license.
- You lose or settle.
- As part of that you agree to a software audit of everything associated with your business.
- They find the code and presumably others.
- For each invalid licensed code, by settlement, you would be required to buy a license and pay an agreed upon amount on top of that.
|
|
|
|
|
jschell wrote: Simple - don't use them.
The problem here is often that the author of the code has no clue about licenses or copyright either.
They'll create a repository on GitHub and assume it's now open source.
jschell wrote: The scenario is as follows.
- You get sued (civil case) because it was decided that you were violating a license.
But how would they know that in the first place?
In my eight years in the industry, I've never seen a code audit.
And even if there is an audit, are they going to check all of our repositories, all with thousands of dependencies?
Or only the ones we consciously downloaded, like jQuery and Angular?
And what happens if I use library x that has an MIT license, but library x uses library y which has a less permissive license and so library x isn't really MIT, but something else.
Should I check if library x is really MIT or if they are in violation with any of their dependencies?
When I download and use library x I also (often unknowingly) download and use library y and so I'm restricted by their license, which I don't know about because the authors of library x are lying to me.
I have no idea how often this happens (because I never check the thousands of dependencies in the libraries I use), but I can imagine this is happening on a rather large scale.
I'm not saying we should all ignore licenses, but I can see how many people have no idea what to do.
Especially if you're not really aware of licensing in the first place.
If it's on the internet and you can download and use it (through npm, NuGet, Maven...) it's free, right?
Simply put, we're programmers, not lawyers.
It's like the law says "every citizen should know the law" (so "I didn't know" isn't a valid excuse in court).
If it was that easy we didn't need lawyers, judges, and four to five-year college studies.
|
|
|
|
|
This is why large organizations (the ones with deep pockets, worth suing) (a) require their programmers to document any open-source libraries that they use, (b) use software, updated regularly, that scans the source code and ensures that no libraries with toxic licenses are used, and (c) have lawyers that vet the licenses of any libraries.
For example, if you are writing proprietary software, any GPL source code is toxic - including it in your source code base would require you to publish the source code of your proprietary package.
Freedom is the freedom to say that two plus two make four. If that is granted, all else follows.
-- 6079 Smith W.
|
|
|
|
|
Those aren't the organizations I work for.
My current organization has a faint idea that somewhere they have a room full of contractors who are writing their software for them 
The (in-house?) IT manager was opposed to Azure because he wanted the software "in de cloud".
The CEO, late in the project, decided that since one of his other companies uses two or three of the same services we needed to use their application (which, other than those few services, is a completely different product).
With that kind of ignorance going around really no one is worrying about licenses.
Heck, I don't even think they know what they are.
Luckily, there's a coworker and me who read licenses until we give up and decide to use something else
|
|
|
|
|
Sander Rossel wrote: Luckily, there's a coworker and me who read licenses until we give up and decide to use something else
I do my due diligence myself so if questioned I can truthfully state that did check the licenses.
|
|
|
|
|
Sander Rossel wrote: The problem here is often that the author of the code has no clue about licenses or copyright either.
They'll create a repository on GitHub and assume it's now open source.
That however doesn't mean it isn't your problem. As I noted if you get, in writing, that the author said you can use it, then that would be sufficient.
Sander Rossel wrote: But how would they know that in the first place?
Disgruntled employee. Random overheard comment. Partner company notices and reports it. Selling a product and someone finds the code. Due diligence for a sale and buyer requires that it be settled before sale can proceed. There are probably others.
Sander Rossel wrote: And even if there is an audit, are they going to check all of our repositories, all with thousands of dependencies?
I know they have automated tools that can check for problems. I suspect they do manual audits as well. This is similar to security audits and since your company is paying for it, it doesn't matter what it costs (to them of course.)
Sander Rossel wrote: And what happens ...
Yes those are problematic scenarios. And those are ones that have come up in the past where a widely used library must pull functionality or replace it because they were doing something incorrect before.
|
|
|
|
|
I should say that I had "early retired" back when auto_ptr was the new k3wl thing. I understand that after that, there have been some other features added that addressed issues that auto_ptr did not completely fix. I wonder if the state of the language is such that there are no more issues with memory leaks - which would indicate to me that no one need bother with calling delete anymore, basically making C++ like its managed cousin C#.
Or am I missing something?
|
|
|
|
|
it is funny actually, because it is very simple to avoid memory leaks in C. You just free the memory.
Along comes an *improvement* calling itself C++, which then proceeds to dig itself into a hole, many times, adding layers of complexity, even more tortuous code, static classes which look like namespaces, unnamed namespaces where static functions used to rule, the magic bullet of exception handling!!!!, ah, but now we are leaking memory, ahaha, smart pointers!!!!!, oh, that didnt work out quite well, kill auto_ptr!!!!!!
And whats the latest attempt to put a bandage on the bandage on the bandage?
There is a reason a screw driver looks like a screw driver, and always has done, for centuries. It does the job!
Can we leave our programming language tools alone? No chance. Too many nerds thinking they can be *improved*.
|
|
|
|
|
Munchies_Matt wrote: Can we leave our programming language tools alone? No chance. Too many nerds thinking they can be *improved*.
No nerd is going to touch my hex keyboard and the processor's machine code.
I have lived with several Zen masters - all of them were cats.
His last invention was an evil Lasagna. It didn't kill anyone, and it actually tasted pretty good.
|
|
|
|
|
Too late, you just touched it yourself. 
|
|
|
|
|
Did you call me a nerd? You .... nerd!
Say hello to old Elf[^].
I have lived with several Zen masters - all of them were cats.
His last invention was an evil Lasagna. It didn't kill anyone, and it actually tasted pretty good.
|
|
|
|
|
And the starwars helmet....
Why do so many nerds collect star war toys? There is a guy at work, has to be 40 years old, and his desk is covered in them.
|
|
|
|
|
I don't collect Star Wars stuff. Some action figures from 1977 have survived, even after I practically sold my childhood for Elf's 4k memory board. It still works, so that was a good investment.
Actually George Lucas lost me along the way. He kept getting younger and I kept getting older. It was over for me when he came up with killer teddy bears. At the moment it's far more entertaining to watch the real nerds pull out their hair and protest against the junk Disney throws at them. If anything at all, I always was more of a Trekkie, at least until Star Trek Discovery. Here also the nerds are pulling out their hair and protesting, very much for similar reasons as the other nerds do.
I have lived with several Zen masters - all of them were cats.
His last invention was an evil Lasagna. It didn't kill anyone, and it actually tasted pretty good.
|
|
|
|
|
Granted I haven't done much C++ (even though it was a long while ago I did tons more C).
But I am under the impression that the memory problem in C++ and C are related to the same problem...
It is just that C program often do simpler things than the more complicated C++ one. To be more specific the most difficult numerical algorithm might very well be implemented in C, but the program with the most object or bits of memory moving around are likely to be in C++.....
So it's premature to boast C superiority!
|
|
|
|
|
Super Lloyd wrote: he memory problem in C++ and C are related to the same problem.
Of course they can be, they are the same language, but the memory problems that were introduced by exception handling, which were fixed by auto pointers, which introduced their own problems, is the kind of 'the fix causes bigger problems that need a bigger fix' problem that C++ has.
Super Lloyd wrote: the program with the most object or bits of memory moving around are likely to be in C++
You should see some of the drivers I have had to write.... Seriously, you want to see data traffic at an elevated rate, heavy memory use, drivers do it. But almost always dont touch the data, they dont care what it is, and you cant do floating point math in the kernel, so no, no fancy algorithms there.
I like C++ when there are distinct objects to manage, but when it is used to control a process I find it cumbersome compared to C. (Drivers are pretty much 100% process)
|
|
|
|
|
Munchies_Matt wrote: Of course they can be, they are the same language,
They are no longer the same language. Haven't been the same for quite some time. And actually the first ANSI C++ spec made at least one change that made it different from C.
|
|
|
|
|
jschell wrote: made at least one change that made it different from C.
Which was?
#SupportHeForShe
Government can give you nothing but what it takes from somebody else. A government big enough to give you everything you want is big enough to take everything you've got, including your freedom.-Ezra Taft Benson
You must accept 1 of 2 basic premises: Either we are alone in the universe or we are not alone. Either way, the implications are staggering!-Wernher von Braun
|
|
|
|
|
added plus plus to name to start with
|
|
|
|
|
ha ha
not
#SupportHeForShe
Government can give you nothing but what it takes from somebody else. A government big enough to give you everything you want is big enough to take everything you've got, including your freedom.-Ezra Taft Benson
You must accept 1 of 2 basic premises: Either we are alone in the universe or we are not alone. Either way, the implications are staggering!-Wernher von Braun
|
|
|
|
|
How global variables were handled - the scope of those.
|
|
|
|
|
In respect of the errors you can make not freeing memory they are, which was the part of the language we were discussing.
|
|
|
|
|
Super Lloyd wrote: But I am under the impression that the memory problem in C++ and C are related to the same problem...
That is correct. Both allow the programmer to control the scope in which an allocation lives. So if the programmer fails to control that then an actual leak is produced.
More so both also allow programmers explicit write control over memory. That makes more serious problems possible. Those are the ones that generally lead to security problems where as memory leaks (in the strict definition) most often just lead to business functionality problems.
Other languages like C# and Java can both have memory leaks (strict definition) but is less likely to occur.
|
|
|
|
|
With C# and .Net I have seen way too many cases of idiotic memory leaks, just because the developers had no concept of an object lifecycle at all. I have also seen an entire team of Java guys sitting around a server that needed a reset every day because their opus hogged memory. If anything at all, the Java Hobbits are even more religious about not managing your memory. And what could all those senior devs, architects and project leads do about the the memory leak? They beat the garbage collection into submission and fixed the symptom - for a while.
Garbage collection and all sorts of automated memory management can't replace a proper architecture and object lifecycles. At best it makes routine work a little easier and offers at best a safety net. At the same time it makes the developers ignorant and careless. The Java guys have made a religion out of it.
As long as I use C++, I simply have put debug assertions into the code that monitor what is going on on the heap and fire when there seems to be a leak. After that it's only a little detective work to identify the type of objects that are piling up and then take a good look at the lifecycle of these objects.
It's actually not so hard and you don't need any fancy features. The only thing you need is to invest a little more thought and give up your 'right' to write careless code. Then again, a little more thinking, discipline and a little less cowboy coding would also solve many other problems.
I have lived with several Zen masters - all of them were cats.
His last invention was an evil Lasagna. It didn't kill anyone, and it actually tasted pretty good.
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
