I had a senior dev at a past job who did this constantly. And when it was found out how much he actually stole, our entire team was laid off and replaced by the company that did the audit.

He just refused to believe that software licenses were real. That and I dont think he could actually code anything from scratch without stealing large swaths of code from open source repositories.

Copy/paste without attribution to license or permission is more blatant.

Organizationally he was given free reign to do whatever he wanted, and that lead to the entire teams downfall. He canceled code reviews... for himself. Well, he actually stated, all code reviews go through him, thus he "code reviewed" his own code. I remember he was once a few weeks late on delivering a basic landing page, and when it finally got to QA at 9pm on a Friday, our entire team was forced to work the weekend and QA gave me a TFS export of more than 200 defects I had to fix because he was unreachable. Needless to say, our entire team was upset we all got laid off, but also relieved because we all ended up in better jobs. At least everyone I've talked to, which is everyone but him, as he has never responded to a single text message or email since he quit after the layoff (he refused severance, and just walked out), all his socials went off line, and any record of his name has disappeared from the internet. I'm fairly certain he was a conman, but I have no way of finding out.

Maybe hired by a competitor to tank the company intentionally? I would not put it past many big companies to do something like that.

That takes some skill. I was almost duped like that by someone we nearly hired for a sales position, which is much easier to fake for a few months, especially working remote.

He can believe the GPL isn’t real all he wants. In that case how did he justify breaching copyright law?

> I had a "senior" dev...

Ftfy.

His resumé seemed to back up his claim. Not sure if it was real, though. HR called every one of my past employers and my references, so I figured they would have followed up on his, too.

Yes, I know the type - I have met a few of "senior" devs that were anything but. I can imagine their past employer didn't even know their true worth, or lack of. Sorry you had that experience.

In all the enterprise companies I worked for we are drilled with required learning and assessments which often include training on software licenses. The aim of these training is devs to keep an eye for license and defer to someone higher up if in doubt. These processes are manual and catch only so much.

In companies with mature software processes there is always tooling that will block a release if it finds unacceptable license. To me it looks like TikTok hasn't properly invested in tooling and this somehow slipped.

Enterprises of even modest size take it very seriously. They’ll be juicy targets to go after. It’s everything between startups to midsize companies where this is not clearly defined. Just ask the VCs who do due diligence. Almost everyone of them will audit your licenses before they invest. One of the things they ask for is the list of libraries you use and their licenses.

As a open-source-license expert dev, in the past I've been able to offer a lot of value to my employer by assembling that list in such a way that the buyer could have high confidence in our audit of dependencies.

This doesn't protect anybody against illegal copy-pasta by ignorant/irresponsible devs, though.

We couldn't ship software until we cleared every bit of code flagged by a tool that scanned our code for open source. Most of the hits were for projects with a safe license and there were many false positives but all in all it was a great step in our static code analysis. I find it astonishing that a company of any size would skip this step.

Well, TikTok is a Chinese company, so it seems safe to assume that it's just part of the culture ?

I think a lot of software engineers nowadays write server software, where they can often be somewhat allowed to be unconcerned with licenses [1], since the actual binary produced from the code lives on the server, and is typically not distributed outside the company.

As a result of this, I think there's this mass misunderstanding of how licenses work in the software engineering field.

[1] With the exception of AGPL if I understand correctly.

A lot of companies do not hire software engineers to implement the system; instead, they contract it to third party (tech service companies such as Cognizant). I think some sort of auditing is done at the delivery, if they concern about the license. But in the context of Java web app, the enterprise software is usually built on dependencies under APA, so it should be of less concern