News for hackers. Stuff that matters.
Re:Crypto optimizations for Go from CloudFlare/Intel blocked... by DannyBee on Tuesday May 19, 2015 @07:13PM (#9573745)
"No, it really doesn't. People have been combining BSD and "other" stuff for decades. "

hopefully, with proper notices :)

"This just seems extraordinarily meta to me. What is the actual risk here? Quantify "messy" and "be safe". " Okay.

The risk is: If you don't reproduce the copyright notice, and Intel doesn't like you, they could come after you for copyright infringement.

Just because you don't hear about it on reddit or hacker news doesn't mean people don't have private enforcement actions over this stuff.

Shocking, I know.

Now, don't get me wrong, Intel is a wonderful company and I love them, but exporting that kind of possible liability onto the rest of the world would be pretty irresponsible, regardless of how nice a company Intel is.

Past that, the other part is "everyone should be contributing on the same terms to an open source project".

Otherwise, you'll soon have a million copyright different notices to reproduce.

Re:Crypto optimizations for Go from CloudFlare/Intel blocked... by ajross on Tuesday May 19, 2015 @08:19PM (#9573964)
So... how is it conceivably "safe" to use Go in my own work, which is provided to me with the same (literally verbatim!) polluting copyright requirement. I love Google, but like you said, all it takes is for me to forget the copyright attribution and you guys are going to sue me into jelly.

Where am I missing the logic here? Or are you offering symmetric contributor agreements to everyone that asks?

Re:Crypto optimizations for Go from CloudFlare/Intel blocked... by DannyBee on Tuesday May 19, 2015 @11:37PM (#9574516)
So, for starters, let me point out that Google's CLA (which would require for contributions like this) grants rights from contributors directly to you. So if Intel signed the CLA and contributed this code, even if you forgot the notice, they would have no recourse.

(https://cla.developers.google.com/about/google-corporate, clause 2)

This leaves "Google itself". In that case, the problem you raise is one true of all BSD licensed stuff, not just Go.

So yeah, you should be careful with notices, no matter who they are from, google or anyone. You are trusting that if you mess up, you won't get screwed by those people. It seems highly unlikely google would ever sue anyone, but like i said, you are trusting it won't happen if you screw up. (I try to be straight with people about stuff like this).

Your only solution to this in toto would be "don't use BSD licensed software" in your works.

Note that this is true of plenty of other open sourvce licenses as well (IE if you screw up GPL compliance minorly, you are trusting the copyright author won't sue you). One of the only ones that doesn't require attribution for binaries is the zlib license. Statutory damages for intentional copyright infringement are quite high, and they don't actually even have to prove they lost profits or whatever.

As for Go, one of the other reasons we don't want to accept other-licensed code and code not under a CLA is so we can fix this problem by changing the runtime library license to not require attribution (but this will take a bit longer for various reasons) :).

(There are certain other languages that know they have this problem with the runtime license, but have decided they don't care if they are likely to make accidental/intentional copyright infringers of large classes of people. I will leave it to the crowd to figure out which these are :P)