Hacker News Reader

Hacker News

Comment by tssva | Hacker News Reader

Parent Full thread

tssva

To save anyone else having to look it up. 51M RUB is currently around US $810k.

View on HN

In Dr. Evil's voice: "One Million Dollars!"

Somewhat surprised this hasn't settled out of court then.

I'd be surprised if it had been. I'd wager Rambler is after the ngnix itself rather than some cash.

Rambler was bought by the Sberbank (the largest state-owned bank in Russia) in August this year

This is a very important detail if true!

https://www.broadbandtvnews.com/2019/04/24/sberbank-buys-int...

But even if they "owned" nginx - what does it get them? The community would immediately fork it and change the branding.

The same happened to MySQL when Sun was bought by Oracle when MariaDB was forked - though I concede MariaDB isn't as popular as I hoped.

> though I concede MariaDB isn't as popular as I hoped

I would think that's more due to the huge boom in Postgres popularity than any failing of Maria. For the projects that do still use MySQL, all the ones I know of are on Maria or Aurora rather than the Oracle implementation.

Not really. The real reason is that Oracle has done a reasonably good job of continuing the development of the Open Source project. You can certainly argue about what things they should have focused on (the MariaDB community has done that, mostly arguing there should be more engines), but Oracle has done nothing to damage the project, and a lot of good in it (serious improvements to the main engine, InnoDB).

If MariaDB hadn't been there, and as competitive as it was, I doubt Oracle would have played so nicely with MySQL.

Oracle has one goal, and that is to make money. They've realised due to the competitive pressure in this case that they can't abandon the community and go straight into value extraction mode.

InnoDB was owned by Oracle since 2005. I don't recall seeing any complaints about that at the time. In 2010, when Oracle bought Sun, then there were complaints from the MySQL team. But not complaints when Sun bought MySQL. Honestly, most people had been using InnoDB as their main MySQL engine for the previous 5 years already but there was no whinging from the MySQL team about that (that I recall).

It's all pretty arbitrary in my opinion -- if Monty and company hadn't whined so much when Oracle bought Sun, I doubt there would have been a fork.

Anyway... it never bothered me one way or the other.

If they're angling for a ruling that they've always had the copyright to the code (or at least core / original parts), then presumably any licenses (FOSS or otherwise) granted by anyone who isn't Rambler would be null and void.

Yes, and while the focus is on the Nginx project, there are probably other projects that used code from Nginx that would also be affected.

Would the community have any right to fork something the original author never had the right to open source in the first place?

No idea what is actually going on, but the "simple" scenario is that it is just a mafia-style bust out. If that's the case, the attackers don't want the source or future development, they want to extract as much money as possible without regard to Nginx as an ongoing concern.

If they indeed have copyright then you cannot legally fork it without them giving you licence to it. Just because you have the code doesn't mean you have the licence. All the other licences would be void.

If you contributed to nginx, do these new owners own your contributions if you submitted them under what turned out to be false pretenses ? Shouldn't all the community contributions be void because of that? That would significantly reduce nginx's worth.

If not, what's to stop other companies doing this in a predatory way? Start an "open source" project, gather years of valuable contributions from a enthusiastic community, then pull the rug?

> what's to stop other companies doing this in a predatory way? Start an "open source" project, gather years of valuable contributions from a enthusiastic community, then pull the rug?

Pulling the rug would mean revealing that your company never really owned the copyright, so at the very least you make yourself look bad.

Also, I don't imagine courts take a favourable view of transfers of ownership which are essentially fraudulent. I'm not a lawyer, as you can doubtless tell, but I presume it wouldn't be good for you if they could prove you'd planned the thing from the start.

There's an analogy outside of copyright: stolen goods. Sale of stolen goods isn't a legal transfer of ownership, but you don't want to be caught knowingly selling stolen goods, much less proven guilty of it (and the whole point of 'pulling the rug' is that things play out in court). I presume a similar principle would apply with intellectual property.

No, these "new owners" wouldn't own these contributions.

But since the project is under BSD license, they could make a case that they are allowed to use your changes (under that license). I'm not sure how that would eventually play out in court, though.

Right, that would be "shared source" not "open source" (or _free software_).

As it is, nginx is licensed under BSD - that would include the many contributions by anyone else (which cannot be claimed if the original project's copyright is found to belong to someone else) - so if the official nginx goes private but the BSD license is found valid, then the community can continue to publish their own "not-nginx" under BSD.

In a worse-case-scenario where copyright of the original nginx project are reassigned and the BSD license annulled, then the community need only replicate something resembling the original codebase that the community's subsequent (and fully legitimately BSD-licensed) patches/changes/commits can be applied to (though this will take some time) - so in either event, the prospective future "owners" of nginx cannot realistically hope to control the world of nginx deployments and the extended nginx developer ecosystem.

> As it is, nginx is licensed under BSD

That has just been cast into doubt.

> copyright of the original nginx project are reassigned

Not reassigned. It would be found to never have been licensed.

> need only replicate something resembling the original codebase

Which is impossible without it becoming derived of the original. If you want to apply a patch to something it must first look like the original. A good chunk of the patches will have been derived from the original substantially. Which means they'd need to be rewritten too.

> the prospective future "owners" of nginx cannot realistically hope to control

Yes they could exert a lot of power and force people into paying. A clean-room effort would take a year! In that year they could go after everybody who is distributing old copies.

This is as bad as it gets if that company is found to own copyright.

In that case, who would pay the new "owner" for the now unlicensed parts provided by outside contributors?

I see this having only two outcomes: either nothing happens (it stays BSD), or it becomes nuclear waste, and new owner cannot sell it because it is plagued by mutually incompatible legal status of different portions of the code.

I can't see how the third version, where it stays clean, but the new owner can milk it, is possible.

Well if it becomes toxic waste they could force everybody currently using it into licensing it from them. They could even try and go for damages for previous use.

But my point it that these customers would not be protected by that license, since they'd be using the code of other contributors without license, so they'd still be potentially open for extortion by hundreds other entities (I suppose there were many contributors).

Hmm yes interesting. Thanks for pointing that out!

The other patch authors could retroactively agree with the robber that their derived publications have been without license. Then they too could block usage of Nginx by pledging to go after anybody who gets a license from the robber.

Don't you understand the trick? If they acknowledge that they "stole" it, Mamut will then go to US and use it as a basis for his claims on the F5, which is like a million times bigger than this claim.

I imagine it's more complicated than that. Settlements can have terms (no admission of fault, etc), and claiming precedent across countries probably isn't straightforward.

Don't you think that these are not things that a person being asked to sign a paper under a gunpoint will think about?

Especially now that F5 owns Nginx.

I don't think F5 is going to lie down and let some shady hucksters take nginx for $$$ from them. They would have already looked at the copyright situation when they bought nginx.

Reply on news.ycombinator.com