danielgtaylor / ladon

A small, simple cross-platform utility to process many files in parallel.
82 stars 6 forks source link

Repo does not contain a license a user can depend on #14

Open nopdotcom opened 5 months ago

nopdotcom commented 5 months ago

tl;dr: When someone wants to reuse this software, they legally depend on your license, and it’s bad to have it only in a separate place. Please either include the exact license as a file in the repo, or specify a precise license version through a well-known standards body: “Copyright 1973, 1975–1978 by Daniel G. Taylor; licensed under SPDX MIT-0”. I will PR any or all of this at your request.

(While I’m at it, should I put in a PR for package.json to change the license field from MIT to MIT-0? The latter accurately reflects your intent, I think?)

You may know most or all of the history below, but this issue wouldn’t necessarily make sense without it.

The web had to suck

Hypertext theory wags might suggest this issue is a dupe of the Issue “transclusion unimplemented (milestone: 2.0)” on timbl/worldwideweb.

The reason the Web works, and Ted Nelson’s Xanadu (and Hyper-G, and HyTime, and…) do not work is that timbl realized that systems like Gopher demonstrated that outward-only, unidirectional links plus a “back” button solve 80% of the hypertext problem. This is a classic “Worse Is Better” situation, where HTML 0.8 with marca’s <IMG> kludge is so useful that the system wins the market, buying time to hack together fixes for the design problems successfullly ignored to get to market first.

One of the intentionally-ignored problems of Web 0.8 was (and is) that your document can’t inline-cite my document: all you can link to are URLs, which just offer access to the resource at a DNS-addressed server now. But in many cases — particularly linking to licenses — you would want to cite the document as you saw it and agreed to it, not the document at the URL years later.

Kludges for immutability

The obvious first thing to do in the existing Web architecture is to add content hashes to URLs, so you’d get something like http://dgt.mit-license.org/#~#:sha256:QxoWgm…z5ow= …except that the resource behind that URL may have multiple representations, depending on the complicated parts of the HTTP 1.0 and 1.1 specs. Still, something like this hack seems likely to be standardized eventually, and it will just be broken for URLs which point to resources which ever vary in any way. “Write once, run away.”

“Real” URLs also have the hard requirement that you can write useful ones on a napkin. You could instead [bip39-encode](https://pypi.org/project/bip39/) the sha256, giving: ``` https://dgt.mit-license.org/#~#:sha256bip:drink,spawn,party,tackle,\ damp,express,cheese,blanket,ignore,twice,extend,grain,pepper,\ life,urban,title,face,surface,document,client,spend,okay,olive,oak ``` …no.

Distributed systems are fun

Even then, distributing the hash of what you saw with the URL doesn’t solve the problem of the server or DNS registration falling over. For copyright licenses, the temporary or permanent unavailability of a license “fails safe” from the point of view of the copyright holder: nobody can distribute the software until a trustworthy copy of the license is found. For open source software, the lack of a trustworthy license copy should halt distribution; from then on, the only thing saving distributors is the hope that the copyright holder won’t suddenly reappear and sue everyone.

(Malicious ownership of mit-license dot org could be…a lot of fun? No no no.)

URNs were supposed to save us, but they’re hard. The closest thing are consciencious standards bodies which give short names to well-known entities and publish the mapping so them going out of business doesn’t invalidate the utility of prior users.

Even ChatGPT knows “IANAL” prefaces sketchy legal advice

I’m not a lawyer, but if I were one, I would advise you to simply reproduce your personalized MIT-0 license contents in /README.md or /LICENSE. Anybody obtaining a copy of your source code by Git or "download source as .zip” then always gets the exact license which covers that software, regardless of whether a third-party server stays up. They’ll get the history/notifications of any changes through the normal Git mechanisms, which is polite.

If that’s too verbose, just write, “You may distribute this under SPDX license MIT-0.”

You can keep your the link too (as long as it doesn’t create a license contradiction with another license; those stories are too long and painful for this Issue). I have an obvious weakness for YTMND-style sites, given I mashed one up with LMGTFY. (And LMGTFY seems to be hosed? Geez, do I need to reimplement that now?)

I wrote all that to try to soften this statement

Unfortunately, I can’t see how a site like mit-license dot info can really help you do what you want to do, without creating unforseeable but inevitable difficulties later for people who’d like to use or reuse your software, possibly long after you’ve forgotten the project. Please encourage unexpected reuse of software by making source packages self-standing.


Footnotes

"Ted Nelson's Xanadu" Ted Nelson, visionary, still serves our crappy Web — often like a Greek tragedy's chorus, pointing out things to the audience that the characters caught up in the action are currently missing. My favorite example is the first issue of "The XML Journal” (how long did that last? don’t answer that) concluded with a piece from Nelson few understood the point of at the time. His subject was that the use of SGML-like markup ultimately implies a document is controlled by a single entity, because of the `Good on this Tuesday` problem. Because structural decomposition of documents is strictly hierarchical, documents must be controlled — or at least coordinated — by a single social entity. An older definition of "Internet-scale” is “supports multiple administrative zones of authority”: I can kick someone’s account off my mail server without coordinating with others. Today’s Web is (mostly) Internet-scale, until you get to the document level.