I just recevied an DMCA takedown from GitHub because upstream is “unopensourced”
I just received a DMCA takedown request for a GitHub repo of mine because my fork of EdgeFS (I started working on a Illumos / SmartOS port) uses sources of EdgeFS. Apparently Nextenta has (more then 9 months later) has come to the conclusion that they want to "un-opensource" it and want to put the OSS genie back in the bottle.
Is this even possible?
The most interesting excerpts:
-------------8<---------
Please provide a detailed description of the original copyrighted work that has allegedly been infringed. If possible, include a URL to where it is posted online.
After DDN’s acquisition of the NexentaEdge source code (as described above), it was renamed “EdgeFS” and was subsequently improperly open sourced under [private] without DDN’s permission.
-------------8<---------
Is the work licensed under an open source license? If so, which open source license? Are the allegedly infringing files being used under the open source license, or are they in violation of the license?
No. EdgeFS was improperly contributed as open source without the authorization of DataDirect Networks, Inc. or its wholly-owned subsidiary, Nexenta by DDN, Inc., the copyright owners.
-------------8<---------
Not a lawyer but,
If it was released under an open source license by people who did not legally have permission to change the license, then yes this is possible.
It sucks, and you should likely still challenge it. But they may have the legal high ground.
It's like if a stolen painting is given away or sold. The recipient is may have no knowledge the painting is stolen and acting in good faith. But the original owners before it was stolen are still the legal owners.
It appears that Nexenta's edgefs code was open source under an Apache 2.0 license at least as far back as 2020-03-12:
https://web.archive.org/web/20200312165928/https://github.co...
... and probably further back too - here's an HN post referencing the licensing from around Q3 2019:
https://news.ycombinator.com/item?id=20671417
I hadn't heard of DataDirect Networks before; it looks like their acquisition of Nexenta closed in May 2019:
https://www.theregister.co.uk/2019/05/07/ddn_is_buying_nexen...
"Nexenta by DDN will be run as a separate entity, retaining its own sales and engineering teams. The Nexenta sales people now get a wider DDN channel to use and there are cross-selling opportunities for both."
As far as I understand -- I'm not a lawyer -- changing a license requires that existing contributors are notified and agree to the change of licensing.
https://softwareengineering.stackexchange.com/questions/5532...
Not a lawyer.
Reading the former license would make sense. But I would be very surprised if any mainstream open source license can be revoked.
https://www.apache.org/licenses/LICENSE-2.0 was the license of EdgeFS if I believe in Google's cached result. There is no mention of a time limit or withdrawal possibility.
Some jurisdictions may restrict my conclusion because they don't allow authors to renounce all their rights - to put something in the public domain for example. But giving an open source license is like selling one, you can not just roll back six years later "please give me this back, I don't want this to have happened"
Plus, if EdgeFS has/had external contribution, changing the license of the project without prior allowance from other authors is an infringement of they copyright.
UPDATE: According to the web archive [2], the LICENSE file was committed first 10 months before Mar 12 2020, i.e. sometime in May 2019. That looks a lot like someone wanted to commit it as Open Source just before the acquisition finalized, and may make your battle harder.
UPDATE 2: Found possible confirmation unfortunately that EdgeFS was not Open Source before May 2019 (retrieved May 8,2020 [3]):
That said, if Github tells you when you forked, and you can show their license file at the time was an Open Source license, then you should be able to point that out. Where things get murky and you may be SOL are if any of these are the case:dmitry_yus 3 points·1 year ago Fair points and let me provide some clarifications! :-) Yes, EdgeFS isn't open sourced at the moment but we are moving in direction of opening it up under Apache License. That's our intent and sooner or later this will happen." As always, I am not a lawyer and this doesn't constitute legal advice, and you should see a lawyer for accurate details.* You Open Sourced it yourself rather than forking via Github
* There was no license file
* You worked on the project for them as your employer at any point
* The fork occurred in May 2019 or afterwards
* The project was uploaded to Github, or Open Sourced, in May 2019 or afterwards
Fighting a DMCA is an uphill battle, as there is no risk to Github in enforcing it, but a big risk for them in fighting it. They make their money off of commercial users I suspect, so if commercial users stop believing Github will uphold their IPR, then they'll stop paying.
If any of the above conditions are true I would expect it to be a steep uphill battle. It may be a steep uphill battle requiring lawyers to fight anyway, since it revolves around IP in an acquisition. What it may come down to is that code Open Sourced before May 2019 is ok, code Open Sourced after that might be under a cloud (and basically means you shouldn't use it unless you're willing to fund a long and painful legal battle).
A sad end to one of the flag bearers of the Illumos effort (I believe I remember reading Adam Leventhal of Nexenta on the Developers Council[1]).
[1] https://web.archive.org/web/20160710123826/http://wiki.illum...
[2] https://web.archive.org/web/20200312165928/https://github.co...
> Instead, we will offer the EdgeFS users a royalty-free license for non-commercial uses subject to the terms of our EULA.
That line is in the DMCA request.
I'd guess the investors were told they were paying for this IP but didn't take fast enough steps to prevent a legitimate officer of the company from open-sourcing it.
Adding to other sources I found in a reply to Communitivity: https://twitter.com/nexenta/status/1141728687357857792?s=20
Tweet text : Next week, our CTO and Nexenta Founder @dmitryy will be speaking at #KubeCon 2019 in Shanghai, on NexentaEdge, and the power of open-source projects (@edgeFS and @rook_io !). Get details here: http://ow.ly/SeTD50uJ0yX
undefined
I was researching k8s store offering and found https://rook.io and rook support edgefs with stable status https://github.com/rook/rook#project-status
This post make me never use egdefs in any form.
In addition with other comments, you Can look at what are your contributions and code changes. All the parts that are completely reworked by you could be considered as yours. And you can also ask them to ensure that they don't use your own code/modification as a retaliation of the code not being open source.
undefined
wow, that's just stupid. Buying an opensource product and then trying to un-opensource it. Good look with the troubles, hopefully there is someone here on HN who knows any good legal defense people ( EFF ? )