Truth Social broke software rules, says copyleft group | Hacker News Reader

Truth Social broke software rules, says copyleft group

theverge.com

82 pointscoloneltcb128 comments

I mean…if it was anyone else I’d say it’s good that they’re suing, they should be able to easily prove this, etc.

But this man has made a lifetime out of screwing people over and ignoring rules. There have already been literally thousands of lawsuits against his companies. Therefore, I strongly suspect this will be yet another instance of him using the law to delay, delay, delay, and by the time anything happens he’ll still have gained something. Heck he’ll probably counter-sue on some ridiculous basis.

We live in an age where things move very fast and we desperately need something better/faster than law courts to sort these things out.

> We live in an age where things move very fast and we desperately need something better/faster than law courts to sort these things out.

"I hereby declare all cilantro lovers as heretics and therefore automagically sent to the gulags for re-education."

Umm, no.

What does re-education look like ?

In this case, calmly, yet firmly explaining that cilantro tastes like soap to a small percentage of the population [0].

[0]: https://www.britannica.com/story/why-does-cilantro-taste-lik...

I think there is a reasonable point though. Courts are backed up, the Senate is always slow at confirming (and some presidents slow at nominating) judges. And there's not enough Judges or courts to handle our population/amount of suits?

One negative consequence of this is the amount of plea deals and the pressures that puts on the accused.

Pandemic seemed to have made it worse.

Another thought would be building out more official specialization to speed things up. I can't find it but there was a HN article a few weeks ago talking about a I think a Texas judge who handled the vast majority of some type of specific litigation. It might have been patents I can't seem to remember. Said because that judicial district has a larger volume of case 'law' and well-defined regulations which is also an odd quirk to me as a non-lawyer - that regions can be different. article was about court shopping too, where corporations use their power to get moved into his court because they get better outcomes.

https://www.uscourts.gov/judges-judgeships/judicial-vacancie...

Confirmations could certainly be a lot faster without being any less thorough. Why does a nation of over 300 million people need to task the same 100 people with this? It could still be 100 people per confirmation but for example there could be several groups of 100 in the government whose job it is to vet people and each group of 100 gets a different handful of positions to confirm.

Screenshot of HTML from Truth Social which still contains Mastadon CSS classes:

https://twitter.com/RealGlenMerlin/status/145106846423215718...

To me what I see here is that the software to run a social media site is available to everyone, but some people don't want social media sites just to reach people, they want to build little empires. Why would you try to build a proprietary application when one already exists if your stated goal is free expression? Why would you attempt to obscurely and illegally re license software that already serves it's purpose? It's honestly a sign of what is slowly happening in social media, things like this and what gab did are the death throes of proprietary interactive media.

> Why would you try to build a proprietary application when one already exists if your stated goal is free expression?

If I could hazard a guess... because that goal is a smoke screen to hide the real intent, exploiting the people on that network. (See any large "free" social network for examples.)

That's basically my implication, or more generally, that the true goals deviate from the stated goals.

Ripping off (A)GPL software is nothing particularly new, but this is a remarkably haphazard and visible attempt to do so.

Unsure if it's the incompetence of the the cover up or the actual violation that's more bothersome for me.

>the incompetence

i mean let's be real who is ever going to work for this thing, the amount of qualified engineers who are going to sign up for Trump's Mastodon media clone you can probably count on one hand.

Which might arguably be the biggest problem all of these companies are going to have, how are these people ever going to find actual developers

I guarantee you there are plenty of smart, capable, clever engineers willing (and likely motivated by sincerer personal belief) to work on Trump's Mastodon media clone.

I'm not one of them, but I also put active effort into not letting my social spheres from taint my view of "the other"'s ability too much.

I'm certain you're right that there are a lot of talented engineers with political philosophies all over the spectrum, many of whom I would whole-heartedly disagree with.

However, Trump and the folks in his immediate circle seem to drive away competence through a special combination of malice, selfishness, pettiness, projection, and short-sightedness that boggles the mind. Set aside ideology for a minute; it seems like not paying the bills is standard procedure for their organization, and I don't know who would stand for it regardless of their ideology.

There are very few of Trump's allies that would ever work for him, either as an employee or a contractor. They can see his modus operandi clear as day.

And yet somehow there are always suckers that he can convince to do his shit for free. Of course there is a promise of payment, but the check never arrives.

Absolutely, the Truth platform will likely fail due to inept management, legal troubles, learning that moderation is actually a hard problem, etc.

I just want GGP to know that there are plenty of smart people willing to work on such a project (assuming they get paid) - and I want to combat this idea that the "other side" is just a bunch of bumbling bozos who don't know the difference between a bit and a byte.

There's likely also a small number of people who would work on this just because they believe in Trump's ideology, and would like to see Truth exist more than they'd like to get paid on a regular basis.

There is a massive pool of engineers that if payed FAANG*1.1 salary would work on anything. As long as they set salaries correctly they will not have any issues recruiting talent.

You also seriously underestimate number of people pissed off about having spout the latest woke tropes to continue being employed at FAANG, those will go for much lower rate.

What? Half of the country voted for this guy. That's a pretty large pool of people to pull from for future employees.

I'm not sure half of them would want to _work_ for him, though. He doesn't exactly have a stellar reputation as an employer.

Seems like the type of person to do something just for the resume pad or the chance of working with rather than working for. Any sane person knows that what ever agreement you start with will 100% be renegotiated later, and paid in full never.

Only ~60% of eligible US voters voted in 2016 and 2020, Trump lost the popular vote both times, "half of the country" did not vote for him.

74+ million did which worked out to 46.9%. That's pretty close to 50% for discussion purposes. That's a large pool of potential employees.

That's about 22.5% of the country, not half.

Might I interest you in a course on statistics and how smaller samplings can be used to extrapolate larger sets?

Then the correct statement would be "half the country would've voted for this guy, based on the number of people who did vote".

> 74+ million did which worked out to 46.9%.

Not of the country it didn't.

> Half of the country voted for this guy.

Significantly less than half of the significantly less than half of the the country that voted at all voted for this guy.

Or, an alternate phrasing, significantly less than half the slightly more than half of eligible voters that actually voted at all voted for this guy.

But, in any case, nowhere near half of the country voted for him.

It feels like they outsourced this, or hired the people willing to do the work most cheaply. More likely they hired the people in their network who had any experience in this space and hoped for the best (Bill was director of engineering for a regional bank? He knows people, right?).

I don't doubt there would be engineers willing to work on this if 1) the pay was right 2) the culture was right. Do they have the executives in place who know how to set those two things to attract the best engineers? All signs point to no.

Could you point to the violation please? I don’t see how users would be entitled to their modified software if they do not distribute it. Using the software is not distribution. Or is it?

That would be the case if it was under boring ol' normal GPLv3. However, it is not; it's under the AGPL: https://en.wikipedia.org/wiki/Affero_General_Public_License

If they've changed it at all, they'll need to release that.

So if my users are my customers or employees, this license would make the product unusable. Maybe.

Where’s the line? The product provides my content, in the form of html/css/JavaScript/whatever. That’s technically software/copyrightable but isn’t a component of the AGPLed product.

Otherwise, I agree that the AGPL would require distribution of software mods to the product. I can’t imagine why they would modify or how the author would detect such modifications.

Sorry, but I’m still having trouble understanding just what modifications are being discussed. Nothing I’ve read yet talks about specifics. There should at least be a smoking gun, no? Otherwise, post a link to the product and you’re done.

> So if my users are my customers or employees, this license would make the product unusable.

No, not at all; you'd simply have to release the changes you make. For the purposes of this article, your 'users' are anyone who interacts with the software.

> Sorry, but I’m still having trouble understanding just what modifications are being discussed. Nothing I’ve read yet talks about specifics.

Mentioned in the article; they've been removing references to Mastodon from Mastodon. Which you are allowed to do, but at that point you have to release any changes you've made.

But from where? Headers? Embedded graphic?

Let me ask another way. Did these modifications require a recompile? Pulling a word out of a config file would not constitute a “modification to the software”, merely use as intended.

> Let me ask another way. Did these modifications require a recompile? Pulling a word out of a config file would not constitute a “modification to the software”, merely use as intended.

Actually, it might. Per section 1:

> The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities.

Mastodon is written in Ruby, and large Ruby programs (particularly Rails) usually use Ruby DSLs for configuration. It's very plausible that changes to the config would trigger the AGPL.

So technically this could mean that every person that has launched a mastadon instance needs to make a copy and release to the world our config files, passwords, DB users and other changes for the world to see? Or we are all in violation of making changes and not re-releasing them? Does it spell out how we need to release them, like upon request via email or have a link to a package via main page or something?

Your passwords and databases are probably not considered code, whereas a DSL that happens to be used for configuration would be.

But let's be clear: copyright holders get to decide when they enforce their copyrights. They aren't beholden to enforcement the way that trademark holders are. It's perfectly reasonable and legally consistent for a copyright holder to prioritize egregious violations (like TRUTH's) while ignoring smaller ones (like Joe Schmoe forgetting to publish his tuning changes).

That not withstanding, copyright applies only to that which is copyrightable. One may not express rights they do not have.

Portions modified may not be subject to any form of copyright protection if the original code and/or modifications are purely functional. Purely functional expressions that lack any creative element are not copyrightable to begin with.

> Portions modified may not be subject to any form of copyright protection if the original code and/or modifications are purely functional. Purely functional expressions that lack any creative element are not copyrightable to begin with.

This is a more abstract observation than is perhaps relevant to the situation at hand, which involves a group of people modifying software components that the current body of software copyright law would not consider "purely functional."

You want a reskinned mastodon with winking Trump and MAGA plastered all over it that badly?

AGPL, which Mastodon is licensed under, was created to address exactly the loophole you've identified.

Under the AGPL, modified forms of the software that are used to provide user services must be distributed under the same terms.

This site is likely to leak user data just like many before it.

If the Republicans are for free anonymous speech, why don't they host Tor servers, write a simple web site instead of a hack and tell all users to use Tor?

Imagine teaching your grandpa how to use Tor.

Do you really have to? It could be as simple as using a different browser (and waiting for a minute or two after startup).

So to truly custom mod mastadon or similar agpl things that could hide some of the secret added sauce.. you could modify the core project to call another code chunk / like a wordpress plugin.. then you'd be required to release copies of your modified source which would just have a new line of code calling for 'other thing'.. it wouldn't have to include the whole 'other thing' like if you added a line bringing in recaptcha

so essentially you could create right in mastadon, or similar project, but you could also break out separate things, like wordpress themes, wordpress plugins, third party addins..

Is this all right?

I'm trying to remember some of the debate back in the day with licensing and WP themes and plugins and such, although I'm thinking that was a different license.

It certainly seems to me like this is going to end up being a situation where there is a publicly available github thing that has nothing of interest other than a few lines calling for a few extra js calls or something for spam / moderation and not the actual code that is hidden in those addins.

If this is not the case with this type of licensing I'd like to know - I've been itching to deploy a mastadon for a while now and would like to know more about restrictions. abuse vectors, all that.

How recaptcha isn't covered by agpl? It's such a huge blob!

Can't say I'm surprised. There are way too many efforts that forego actually developing software.

I’d much prefer someone forego writing a line of code than cobbling together their own scaleable social network.

I don't disagree with that sentiment.

I was looking at perhaps a different scenario, one that might have unfolded like this:

Person A: "I have been tasked with putting together a social network."

Person B: "Well we could base it on Mastadon, it's open source, that is what Gab did. That would save us some time."

Person A: "Great let's do that."

Person B: "We will need to comply with the licensing restrictions for Mastadon though it means giving our changes back to the community."

Person A: "Oh, I don't like that at all, what's our alternative?"

Person B: "Well we could write a new system from scratch but it will take us at least 6 months to get to where these existing systems are."

Person A: "Hmm, that doesn't fit our timeline, how about this, we use the Mastadon code, tell everyone it is our own code, and get rid of any references to Mastadon in the code. Then nobody comes after us and we can be up and running before the 2022 elections season starts in earnest."

Person B: "But that would be dishonest and wrong."

Person A: "Is that what your replacement will say?"

Person B: <grumble><grumble>

Person A: "Okay, since we have agreement let's get to it."

It's not even available yet, is it? If he's not even providing it as a service it's a bit difficult to say he's violating the license until he takes it live.

Besides, we all know the first people to sign up will be those pathetic betas that'd sit there refreshing their feed over and over to be the first one commenting on Trump's Twitter feed.

Is the service even public yet? The license says that users of the service are entitled to the code but if the service isn't open to users I fail to see the violation.

From TFA:

Truth Social hasn’t officially launched. But users could access a test version of the platform, where many of them created prank accounts that flooded the service with false company announcements and even fake Donald Trump posts. (The platform has since been replaced by a waitlist.) The SFC demands that TMTG offer all these users access to the Truth Social source code. “If they fail to do this within 30 days, their rights and permissions in the software are automatically and permanently terminated,” Kuhn says.

According to the article, a beta version was available and the claim is that users that had access to the beta are entitled to the source.

It didn't say that the beta was public. If you run AGPL code on a home server for personal use and someone hacks in I don't think you should owe them code.

If you deploy a "test" version of an app to a public server/domain and send an invite to a closed mailing list for users to beta test it, then that still triggers the AGPL.

You are absolutely correct. As far as I'm aware they never sent any invites though.

edit: Only the users of the AGPL service are owed the code, it doesn't need to be posted publicly.

It did say the beta was public

"Truth Social hasn’t officially launched. But users could access a test version of the platform"

> if you run AGPL code on a home server for personal use and someone hacks in

No one hacked in [1]

"we could find no evidence that someone illegally broke into the website [...] the site was simply deployed live early as a test, and without proper configuration [...] people merely used the site legitimately to register accounts and use its features"

https://sfconservancy.org/blog/2021/oct/21/trump-groups-viol...

I think if you run AGPL code on a public server and someone breaks into it, you also don't owe them the source code because unauthorized access isn't legitimate use.

What is the definition of a "user"? Is every visiting rando from the Internet a user? If a person has five sock-puppet accounts, is that five users or one?

If a software robot creates an account, is that a user? Do we owe the source code to the robot? Or to the author of the robot?

Are users of the service entitled to free-of-charge access to the source code? Or could you comply by stating, "for a processing fee of $17,750 USD, we will mail a thumb drive to a real person's residential address"?

>Is every visiting rando from the Internet a user?

Yes.

> If a person has five sock-puppet accounts, is that five users or one?

Each of those sock-puppet accounts can request the source, so 5. No wait, it's still a single human being, so 1. Either way, it doesn't matter. They can request the source, and they should get it.

Are users of the service entitled to free-of-charge access to the source code?

No, with limits.

https://softwarefreedom.org/resources/2008/compliance-guide....

>GPLv2 permits “a charge no more than your cost of physically performing source distribution”. This fee must be reasonable.

> Each of those sock-puppet accounts can request the source, so 5. No wait, it's still a single human being, so 1. Either way, it doesn't matter. They can request the source, and they should get it.

The answer is complicated.

If I hack into a company and steal a binary for an internal tool (that uses GPL licensed stuff), I can’t demand the source code because I was not authorized to use said binary.

If its a beta not designed to be used by the public, it’s not clear how it will go. The users weren’t authorized to use it but it was easily accessible.

See also: the horrific CFAA Act

OK. Now, further, suppose you're the member of some copyleft outrage group and have heard that someone broke into a company and obtained an internal tool based on GPL-ed code. You jump up and down and scream that the person be given the source code in 30 days, or you will somehow terminate their license to use that code.

Does that fit what we are looking at here?

From my outside view as a non-lawyer: probably

That's interesting; so if I have a developer make $50K worth of changes to some GPLv2 program, I still can't charge more for distributing it than the cost of the distribution errand.

The way you get paid is not to do the changes until/unless you have some work contract in place beforehand. If you've already made the changes, you mustn't try to get paid for them.

I didn't even notice that all these years.

I think that's a misreading. That clause only limits additional fees charged to existing users for access to the source code.

You can make the changes and charge whatever you want for the software. When the user requests the source code, as is their right, for that you can only charge the physical costs.

The intent is to prevent expensive source code fees from being used as an end-around the source disclosure requirements. It also makes sure the distributor can cover the cosrs, but no more than that.

> I think that's a misreading.

Right? But since that's a legal document, possible misreadings can end up exploited somehow.

Even something like an ambiguous comma can be at the crux of a dispute

https://www.nytimes.com/2018/02/09/us/oxford-comma-maine.htm...

You can release your changes under a proprietary license, then relicense as GPL when you receive money. If you don't release it into general availability, you can simply revoke it.

> >Is every visiting rando from the Internet a user?

> Yes.

According to what legal doctrine, where, though?

The "user" is a party in the license contract, so that requires a concrete, identifiable legal entity --- or so I would naively think, IANAL and all.

> Is every visiting rando from the Internet a user?

Yes.

> Or could you comply by stating, "for a processing fee of $17,750 USD, we will mail a thumb drive to a real person's residential address"?

The author doesn't have to distribute their clause for free, but I assume there's some clause about not being allowed to charge an outrageous price. More importantly, whoever pays for the initial distribution will be allowed to further distribute it for free.

See https://www.gnu.org/licenses/gpl-faq.html#CompanyGPLCostsMon...

If Trump is sincere about wanting to have a space for free speech, then he should comply with the GPL. If his goal is to grift off appearing to champion free speech, then attempting to steal from the free software movement is clear way to prove himself as such. Then again, I guess there is always option three: rewrite a proprietary one, saying he had no knowledge that the engineer(s) were stealing code (not an outrageous claim honestly). I gladly await the hate for not taking a particularly partisan view of this issue.

The SPAC is up almost 1000% in less than 48 hours. I suspect the courts & media will find some way to tear it down.

> The Trump Media and Technology Group (TMTG) has 30 days to comply with the terms of the license before its access is terminated — forcing it to rebuild the platform or face legal action.

Is that true? Wouldn't the actual copyright holder of the software have to assert this? Are the SFC making this specific demand, and are they the copyright holders?

Moreover, before the copyright proprietor takes action, wouldn't there have to be a legitimate complaint from a user of the site, who wanted the source code but had been denied? Otherwise it's a one-handed clap.

I'm looking at a Mastodon repo on github. Is this the right thing?

https://github.com/mastodon/mastodon/

This has serious issues. There is a LICENSE file in the root directory, but this doesn't mention any authors; it's just a copy of the AGPL. There is a copyright notice in it naming the Free Software Foundation, but that pertains to that file itself, not to Mastodon.

The presence of this file tells us that someone has put Mastodon under the AGPL, as a big umbrella license for everything in this tree.

However, individual source files lack copyright headers.

For instance, no copyright header in this randomly picked file: https://github.com/mastodon/mastodon/blob/main/app/mailers/a...

I see the AUTHORS file, but this is just a list of poorly identified github accounts and such. It's not clear who wrote what (unless we go digging through git history, I suppose). Anyway, these people don't seem to have assigned their copyright to the project, so the copyright proprietorship (who wrote what) boils down to looking at the git blame of every file to get the set of authors who touched any line.

In summary, this project appears to be a bit of a gong-show, in terms of licensing.

If I deployed this, and some copyleft group started harassing me, I'd ask them to write me another e-mail, this time from one of the accounts listed in the Mastodon AUTHORS file, and specifying a list of the files of which that account is an author, substantiated by git blame analysis.

If I had not modified any of those files, I'd reply "have a nice day".

I haven't done a close reading of the license text, but is there a specific point in time or condition after which someone is obligated to share their forked source code? Can you only clone the source via git into another public repository, or is there some other condition that causes your changes to become publicly available?

This could signal an interesting future, as it's probably a trivial change for this company to comply with the license terms, but a scenario where an organization like the SFC becomes the new RIAA/MPAA of selective enforcement is something worth considering. Sure, the rules are the same for everyone, but their enforcement, well...

> I haven't done a close reading of the license text, but is there a specific point in time or condition after which someone is obligated to share their forked source code? Can you only clone the source via git into another public repository, or is there some other condition that causes your changes to become publicly available?

For the AGPL, you're required to share your changes as soon as you begin serving those changes to users. That includes running a quasi-open beta with your server software, as "TRUTH" appears to have done.

Now I'm trying to parse the legal language. Section 5 appears to relate to this, but it's about "conveying," which in the license definitions, excludes providing access to a service that uses it.

> To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.

I'm sure the Mastadon author has constructed their view based on a more strategic logical parsing of the license, and for now they have succeeded in making the brand story about how it's just another example in a long line of frauds and thefts as was what seemed to be the straightforward intent.

However, litigating software licenses as part of partisan lawfare can have knock-on effects for everyone else. I'm imagining what developing new products will be like in a world with something like the SCO patent litigation but by people with tumblr accounts and backed by superpacs.

Refer to section 13.

The requirements imposed by the AGPL are unambiguous: if you host a server using code from an AGPL codebase, you are required to provide networked access to the source code for your modifications.

There's nothing particularly "partisan" about it: it's a remarkably straightforward, cut-and-dry AGPL violation. Stretching immediately for partisan motivations shows your hand a bit, as does comparing enforcement of a copyleft license to the SCO debacle.

Section 13 begins with "Notwithstanding any other provision of this license..." which opens it up to a whole bunch of mitigating circumstances. The AGPL can score some points and the company changes its practices and everyone moves on.

It may very well be an easy GPL violation, but if you want to completely destroy FOSS, hand enforcement mechanisms to partisans. It's only an issue because of the pariah involved. The article also stated this is just a straight forward AGPL violaiton, and surely it only came to the authors attention likely due to the prominence of the user, but I'd warn that FOSS licenses are artifacts of technical collegiality and trust that is no longer a feature of the society the software operates in.

The story is about a social pariah triggering a license enforcement action, and we need to seriously consider the consequences if those two things are related. The SCO debacle hindered the adoption of FOSS in the enterprise for years just by isolating the projects with the legal threat. Those were naive times compared to what goes on today. Whether it's my hand or just an unfamiliar example of principle is left as an exercise.

> Section 13 begins with "Notwithstanding any other provision of this license..." which opens it up to a whole bunch of mitigating circumstances.

I welcome you to find a countervailing provision within the AGPL that permits TRUTH to host a service based on their Mastodon fork without distributing their changes. That would be, in legal terms, a "doozy."

> The AGPL can score some points and the company changes its practices and everyone moves on.

This is, as far as I can tell, precisely the intended outcome: the SFC intends to compel TRUTH to comply with the terms of the software they're using. Once they do (i.e., "change their practices"), they are perfectly free to continue using it (i.e., "move on").

As for the rest of your response: it's the same handwringing. The terms of the license are clear; Trump's status as a pariah doesn't entitle him to special relief from the terms of a software license.

I'd say they can just distribute their changes to remedy the situation and issue is resolved, or they can do the litigating you are asking for, and then be mindful that as a pariah organization they are the canary in the coalmine for FOSS license lawfare.

Indeed, I don't think anyone would offer them special relief, but if this issue shows we are in an era of political exposure to opportunistic enforcement, that's notable for everyone who develops products.

> I'd say they can just distribute their changes to remedy the situation and issue is resolved, or they can do the litigating you are asking for, and then be mindful that as a pariah organization they are the canary in the coalmine for FOSS license lawfare.

I'm not asking for litigation, nor has the SFC threatened any. They've told TRUTH to comply with the licensing terms of the software that they're using, and they've given them a month to demonstrate compliance before taking any further steps. They can do precisely what you just said ("distribute their changes"), and everybody would walk away satisfied.

... The AGPL has been around for about 20 years; it's not some new scary thing. If you don't want to comply with the terms, don't use software that uses it. If you do use software which uses it, you must comply with the terms. This is very simple, and nothing at all like the SCO litigation.

Reply on news.ycombinator.com