need copyright notices and clearer license info inside CSS files

[Nick-Levinson]

If you want to have the MIT license or any copyright license govern main.css and/or normsalize,css, you need to put a copyright notice in it and then you need to point to the license, either by providing the text of it in each file or by giving a URL for it. Simply writing "MIT License" is not notice enough; nor is pointing to another file in the .zip file, since a potential infringer willing to do the legal thing may read an installed .css file outside of a .zip file, something you encourage because .css files are normally to be installed into websites without any other files from this particular *.zip file. I'm not a lawyer, so feel free to ask one, but right now an infringer would have the defense of innocent infringement, still illegal but with less of a cost to the infringer. Since you have reserved an obligation in the license, you evidently don't want your work released into the public domain.

[patrickkettner]

Simply writing "MIT License" is not notice enough

According to whom?

On Sat, Jan 3, 2015, 4:09 PM Nick-Levinson notifications@github.com wrote:

If you want to have the MIT license or any copyright license govern main.css and/or normsalize,css, you need to put a copyright notice in it and then you need to point to the license, either by providing the text of it in each file or by giving a URL for it. Simply writing "MIT License" is not notice enough; nor is pointing to another file in the .zip file, since a potential infringer willing to do the legal thing may read an installed .css file outside of a .zip file, something you encourage because .css files are normally to be installed into websites without any other files from this particular *.zip file. I'm not a lawyer, so feel free to ask one, but right now an infringer would have the defense of innocent infringement, still illegal but with less of a cost to the infringer. Since you have reserved an obligation in the license, you evidently don't want your work released into the public domain.

— Reply to this email directly or view it on GitHub https://github.com/h5bp/html5-boilerplate/issues/1655.

[arthurvr]

Simply writing "MIT License" is not notice enough

According to whom?

Closing this issue till you provide us more info on this.

[QWp6t]

According to a few interested groups on the matter, "MIT License" can be ambiguous since there have been a few variants of it.

http://en.wikipedia.org/wiki/MIT_License#Various_versions

[arthurvr]

I don't know enough about this kinds of stuff. Going to re-open till it's cleared up. Also cc @necolas, since this seems to affect normalize.css too.

Somebody who knows more about this kinds of stuff? Maybe linking up our LICENSE.md inside of this header might be a fix? Is there an actual problem with having it like this?

[roblarsen]

What the jquery folks do is probably the safest, short of reproducing the entire license (which is the only method that is not disputed somewhere when you start to look into this.)

[arthurvr]

@roblarsen Where are they doing that? They just link up the license: https://github.com/h5bp/html5-boilerplate/blob/master/dist/js/vendor/jquery-1.11.2.min.js#L1.

[roblarsen]

I didn't say they included the entire license.

I said, "what the jquery folks do is probably the safest" meaning linking to the license is probably safest.

I then added: "short of reproducing the entire license" Which is a second point indicating that reproducing the entire license (which no one will do in minfied code) is the only surefire way of ensuring the license is properly included.

If you research this for any amount of time there are no clear answers. The only surefire way is to include the entire license. Linking to a copy of the license on the web is second best -- and is probably enough.

[arthurvr]

Sorry, @roblarsen, misunderstood you. And yes, linking up the license is probably a right better solution. Would like to hear some more opinions on this tho.

I don't think we're going to include the holde license at the end it's a css file people will work in so we want to keep minimal.

[QWp6t]

@roblarsen said it perfectly. That's basically the consensus as far as I know. If you want to be super clear about the terms under which your code is licensed for reproduction and distribution, then you should include the entire license in your code. Short of that, however, providing a URL to the license within the code is probably sufficient as far as I know. The reason there is a lack of certainty is because these licenses and these methods of licensing haven't been well tested within the courts.

It's important to note that the distribution of the license is to protect other developers who use the code, not the copyright holder. Copyright holders are protected regardless of whether the licensing information is included. If no licensing information is included, the courts would automatically assume that the code has not been licensed for copying or distribution, and the onus would be on third parties to demonstrate that they received permission to reproduce the copyrighted work.

[arthurvr]

Seems like including our license url is the thing we're going to do. Thanks to @QWp6t and @roblarsen for clearing stuff up!

We definitely want to keep the header of the css file minimal, so having the whole url to the license is kind of a problem. Setting up a short url might be possible, but that would be against what we decided in https://github.com/h5bp/html5-boilerplate/pull/1619. Thoughts?

[roblarsen]

h5bp.com/license is plenty short (and I mean that as a static file, not as a redirect to the license on github)

[Nick-Levinson]

A copyright notice gives your copyright owner/s more protection than omitting it does, the best place to put it is at the top and before any reference to the license under that copyright, and I'll be glad to add the copyright notice to the copies I install of main.css and normalize.css if you let me know what it should say. It should take the form of "Copyright [year/s] [original copyright owner/s]". Please let me know what year/s and name/s should be added. You may know that information is not copyrightable, the copyright applying to the expression of that information, so that if person A supplied information in year 1 that persons B and C expressed in a style sheet or style sheet template in years 2 and 3, the notice would state only years 2 and 3 and only persons B and C.

The need for a notice, the general form it takes, and that "MIT Notice" does not come close to resembling a copyright notice are so widely known among the general public that the first respondent's request for further research appeared to be a request for a deep briefing based on statutory and case law, which would have taken a few hours to assemble and write, which is partly why I didn't reply to the first answer. Most books I've ever seen on how to copyright a work or on the law of copyright, written for either authors or attorneys, say pretty much the same thing on point. It appears that most major software companies rely on Federal statutory copyright law and publish notice reserving their copyright claims. Because of the public knowledge of notice and its form, an omission of notice would presumably be intentional.

The phrase "MIT License" is informative mostly to those of us geeks who know something about it. No law is likely to support using the unaccompanied phrase as legal notice of copyright. In this context, it could mean that the *.css file saying it was obtained under the MIT license, without implying anything about the next user.

Unless the license itself had said otherwise, there's no legal need to reproduce the entire license in a .css file. You needn't say anything unless you want people to know about it. You presumably want people to know the .css files are copyrighted even if they discover the files outside of your zipped file, so you need a copyright notice in each .css file. It should be placed where it's most likely to give notice to a reader, so it should be near the top of each .css file. Whether, how, and where to tell a file's readers how to get any kind of permission under that copyright is at your editorial discretion. Phrasing like "Use, copying, modification, . . . are permitted under the MIT License ([URL])." is likely sufficient. You could even say just "For permissions under the copyright, see the MIT License ([URL])." The form last proposed in this thread would be legally sufficient; it's up to you whether it would suffice for purposes of encouraging reuse and development of the *.css files.

The license itself, as you supply it in the .zip file, has a copyright notice, but, because of where it appears and what it says, it applies only to the license itself, not to any .css files, and the license file would normally not be installed on a user's website. (The license was probably written for files where the normal exposure was different than is the case with *.css files in the wild.) Also, the license file does not mention MIT and the copyright notice says that HTML5 Boilerplate owns the copyright on the license, unlikely but not impossible (your arrangement or enhancement might be under your copyright) but is not indicative of an MIT interest. If your copyright is only in enhancement and arrangement and not in the substantive expression because someone else (I guess MIT) has the copyright in the latter, your copyright notice overclaims, and you're generally not allowed to overclaim, after allowing for reasonable disagreement about what is yours and what is another party's. To prevent overclaiming, this phrasing will work: "Portions copyright [year] [creator's name (perhaps yours)]".

Please let me know what copyright notice to add on your behalf to the *.css files I install from your set. Thank you.

[QWp6t]

A copyright notice gives your copyright owner/s more protection than omitting it does

In what way does a notice give copyright owners more protection?

Copyright owners are protected regardless of whether a notice is displayed. An innocent infringement defense only protects infringers from statutory damages, not restitutionary. That is, the copyright owner is still just as protected and will be made whole. As far as I know anyway.

[arthurvr]

@Nick-Levinson We're working on h5bp.com/license. Would you mind opening an issue for normalize in their repo? If you want you can PR the change in here. Thanks for reporting this!

[Nick-Levinson]

On whether a notice increases protection, @QWp6t, you've prettty much said it. I didn't remember the detail but I'll take your word that it's what you've said. All else equal (e.g., the likelihood of a case being brought and proven), a bigger penalty is more of a deterrent and therefore is more protective against infringement. And probably a typical copyright owner would prefer gaining deterrence over trying to collect compensation, because more of the potential infringers will be deterred than will have to pay.

I'll look at following up for the other file as you suggested, @arthurvr.

[alrra]

@isaacs looked into this for npm (see io.js's TC Meeting from 2015-01-07), and the conclusion was that a LICENSE file in the root is enough.

We do include for quite some time a LICENSE.md file in the root of the project, however, we do need to also add the LICENSE.md file to the dist/ directory in order for the distribution package to also contain it (I've opened a pull request for that). Otherwise, IMHO, we're good (do note that we currently do not distribute main.css file separately, and the information included in it has more of an informative role then anything else).

[Nick-Levinson]

Judging from the linked discussions, I think your lawyer/s likely understood the issue and the apparent nonlawyers did not, but it's your decision, not mine. That leaves me trying to figure out what to do with my copies of the two H5BP *.css files if and when I install either or both, probably with my modifications. If your latest version has not fixed the problem of a lack of copyright notice in the files that, when installed, are separated from the rest of the H5BP download, I'll try to write some kind of notice to avoid the notice about my work being a legal overclaim and to protect your contributors' rights (from which the MIT license then emanates). It is not necessary to list every contributor if there are many, but it probably is necessary to provide a notice that in turn allows determining to whom the copyright belongs. If you have advice for what I should do, please let me know. Otherwise, I'll use my own judgment. Thank you.

[patrickkettner]

@Nick-Levinson I would consult a lawyer.

Since no one here is one (yourself, and I included), and the ones who were consulted (on behalf of npm, inc) said what you are asking for is 100% unnecessary.

[Nick-Levinson]

I agree on a consultation as being appropriate and that would be by someone from H5BP, which I'm not. And, no, that was not their view as reported in the linked-to pages, except that I couldn't play the video (I refuse to install Flash since it causes a security issue), so maybe it was in that. However, the recent written comments mainly discussed the license. I opened this discussion to be about the copyright notice. Very different. Possibly, some people are from elsewhere than the U.S. and are unaware of innocent infringement as an issue that can lower the benefit to your contributors if copyright notice is not posted in the documents that are meant by H5BP's encouragement to be separately used, namely the *.css files. And minifying should be selective, so as not to strip out a copyright notice.

[alrra]

I refuse to install Flash since it causes a security issue

@Nick-Levinson See io.js's TC Meeting from 2015-01-07 using YouTube's HTML5 player.

@Nick-Levinson Thank you for your opinions, but I'm going to lock this discussion, as right now, continuing it in this form isn't helpful in any way.

Note: If someone is a lawyer or has consulted a lawyer, and can prove (not just state their opinion) that things are different then what was said in this comment, feel free to open another issue!