search

samyk / evercookie

Produces persistent, respawning "super" cookies in a browser, abusing over a dozen techniques. Its goal is to identify users after they've removed standard cookies and other privacy data such as Flash cookies (LSOs), HTML5 storage, SilverLight storage, and others.
https://samy.pl/evercookie/
4.42k stars 663 forks source link

New BPL license simplifies down to "anything other than reading this license is illegal" #117

Open ssokolow opened 7 years ago

ssokolow commented 7 years ago

...OK, it's not April 1st, so would you mind explaining why you put this under a license where the intersection of the situations where the terms are met is an empty set?

(Hell, the only reason you're allowed to post such a project to GitHub is that, by creating a GitHub account, you agree that GitHub is granted a license to host and display the contents of anything you post to GitHub, independent of any other license it may be under.)

If it weren't for the fact that I have yet to find any explicit license declarations in previous releases, I'd just conclude you'd gone insane and encourage people to fork off an earlier revision.

samyk commented 7 years ago

You can also share, distribute, and add on to the code. Clearly that's quite lenient of me.

ssokolow commented 7 years ago

But only if you do so without reading, which basically means vim foo.js; cat evercookie.js foo.js > new_evercookie.js.

Not very useful.

On 16-10-08 10:59 AM, Samy Kamkar wrote:

You can also share, distribute, and add on to the code. Clearly that's quite lenient of me.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/samyk/evercookie/issues/117#issuecomment-252429040, or mute the thread https://github.com/notifications/unsubscribe-auth/AAC3Q1fH9OhzwhIL3uLzBa7wmqqJACm8ks5qx6_EgaJpZM4KRvGL.

ssokolow commented 7 years ago

I don't see how commit 79003735a5035a342d69db11319be0285e7f5aea really changes anything. A human cannot execute code in any meaningful sense, so saying "any person ... execute" would still be interpreted by courts as "any machine ... execute ... on behalf of a person".

sandeep45 commented 7 years ago

@ssokolow when you have it, could you please share the MIT licensed forked project here?

ssokolow commented 7 years ago

I didn't check every revision, but the revisions I did check had no explicit license, which means that, in some jurisdictions, they'd be "All Rights Reserved" aside from the limited license granted by GitHub's Terms of Service.

mikeg-de commented 7 years ago

@ssokolow Is this an issue at all? There won't likely be the situation where someone will sue someone else as the intention of this project is to share. Though, it could be said there is no one with the intend of suing. Please feel free to add what's missing from you point of view as it seems you are the one who can add a lot of value in terms of licensing.

samyk commented 7 years ago

@mikeg-de ++

ssokolow commented 7 years ago

I have places to be today, so I probably won't get started on an answer until tomorrow, but I'll need a plain-English summary of what the license is actually intended to mean before I can make any suggestions.

(And, just a warning, I'm not a lawyer... just a programmer who's spent a fair bit of time reading licenses and articles about how they've interacted with the world of open-source software and has an excellent grasp of the nuances of the English language.)

...and, that aside, I strongly recommend against self-written licenses. The problem is that, because it's easy to produce un-intended consequences, they're effectively "viral" in the way Ballmer tried to cast the GPL.

(People who are aware of the risks treat codebases containing novel licenses as toxic because they know enough to know how little they know about the ins and outs of licensing.)

vibrantBits commented 7 years ago

Cmon, "does not allow any person to read, view.. the code". Thats totally absurd. Is it really what you meant?

ssokolow commented 7 years ago

To be fair, I believe the part of that particular point which you quoted is overruled by the Terms of Service he agreed to when he uploaded it to GitHub.

samyk commented 7 years ago

Totally what I meant. You didn't look at the code, did you? I may have to send the code police after you (but I promise they're not as aggressive as the stylistic police).

ssokolow commented 7 years ago

Well, based on what I've observed in legal circles, I can't see how it could be interpreted any other way.

Even if I'm wrong, the only people who don't follow the worst-case interpretation of an untested license are reckless people who don't understand it and people who are trying to get away with something and either don't think they'll get caught or are willing to fight it out in court.

samyk commented 7 years ago

Outlaws? Sounds like my kind of people.

ssokolow commented 7 years ago

Yeah, but outlaws already probably have their own solutions for doing evercookie-style things. There's too much money in compromising people's privacy.

As-is, if I can ever find time to get the projects which can benefit from it off the ground, I'll probably just write my own MIT or Apache-licensed evercookie competitor to bolster the "shadow-banned for abuse" system by clean-rooming from the list of mechanisms it supports.

backus commented 7 years ago

Looks like you got what you wanted @ssokolow. There is now no license.