My open source project got stolen by a HN user

For more context, the author of the fork seemed to have stepped in to "answer" some of the concerns in the Reddit thread by OP, and some of it is just plain hilarious.

https://www.reddit.com/r/nextjs/comments/17wujjc/my_open_sou...

Claiming that the project is "a copy of a copy" because the author forgot to switch the license from the template MIT which had "Vercel" in it - https://www.reddit.com/r/nextjs/comments/17wujjc/comment/k9j...

Claiming code (!) contributions to the project, while there is only a single commit by him (fixing typos) and he has an unresolved conversation in a single GH issue - https://www.reddit.com/r/nextjs/comments/17wujjc/comment/k9j... (the commit is https://github.com/avitorio/outstatic/commit/442a3189697540e..., issue https://github.com/avitorio/outstatic/issues/73)

I checked the source code in both projects and it seems that a fair amount of rework has happened already. They don’t really look alike beyond bits of structure and the basic layout.

This is exactly the intent of a MIT license. The only unfair aspect is that they seem to have removed the original license notice, which is a requirement.

Their project is MIT licensed too, so if you like what they’re doing you can play your Uno reverse card!

Relevant portion below, taken from this page (https://dev.to/sadeedpv/someone-copied-my-code-on-github-and...):

'With the MIT license, you should really also put your copyright and license notices at the top of each source file in a comment in addition to the license file in the repo. This way if someone uses one or more files but not entire repo, your copyright notice and license declaration stays with your code, unless they deliberately remove it. With only a license file you risk someone who only needs one of your source files separating those notices from your code accidentally with no ill-intention toward you or your work.'

Sorry disclaimer, I'm too lazy to immediately check everything myself, but will, and will write confirmed or not-confirmed.

So, I read comments and few surface details. What I note:

1. Original project is MIT licensed. MIT only forcing, IF you use it, to make special page with mentions of all MIT licensed code used in project and nothing more.

2. ANY software project could being divided to separate independent parts, which will be then rewritten based on clean room methodology, and after this you could just remove ANY mentions of MIT licensed code which was used earlier. As I understand, person who copied your project, rewritten all your code himself and NOW he have not any your code in project.

Unfortunately, now you only can do something much exceed properties of your tween, so he will have to race with you or you'll win.

It is definitely unfair at say the least. I do see that their About text in Github has outstatic but that is it. If the code was directly copied pasted (regardless of MIT license), he should at least mention your project as a courtesy. This is why we can't have nice things. I don't know how to help you more but I do feel your pain and I wish there weren't people like this in the world. But they do exist.

Well, your license gave them permission to pretty much do anything. As nefarious as it may be, it is not illegal.

https://github.com/avitorio/outstatic/blob/canary/license.md

I think you're right that he stole your work without proper attribution. I'd suggest reporting his Reddit thread(s) if you haven't already. Or start a new thread like this HN one.

Elegant-cli's author's mistake was not including a full-text copy of your MIT license (which has your name) in the repository (his own MIT license does not count as a "proxy"). That is precisely what the MIT license requires, and hence a direct non-compliance by Elegant-cli.

However, the MIT license does not dictate how Outstatic should be mentioned in Elegant-cli's marketing materials (like their website or README file).

Though poor etiquette, it is permissible for Elegant-cli to not mention you or Outstatic anywhere else, so long as full-text license copy with your name is included in the repository.

If you needed that kind of attribution, you should have picked something like the BSD-4-Clause (https://spdx.org/licenses/BSD-4-Clause) or MIT-advertising (https://spdx.org/licenses/MIT-advertising.html) licenses, instead of the MIT license.

The first thing that came to my mind after reading your post was the philmarilion from 4chan. Collecting these posts and submitting them with all these commentaries is.. a bit creepy. I find collecting stuff to be a good idea, but publishing them in this manner is another thing, seems to be a very knee-jerk reaction.

When I compare the two projects, I do see that you are right, he obviously just copy-pasted, I do understand your outrage. Why are you trying to shame him here, where your post will be compost in a matter of hours, instead of opening an issue or two (phrased more diplomatically) in his github project, and post the link here?

I wonder what you want to get out of this, and what damage his clone is causing you and your project?

I've had my website cloned before and I totally get the feeling and absurdity of the situation, but realistically there is not a lot you can do without it (negatively) impacting you as well.

I think it's good to message this person, as they probably should include your license, maybe indeed make people aware, but at some point it might be better to let it rest and focus your energy towards your project.

Especially if it's not really a threat to your project (and it doesn't look like it is as your project seems like it's doing quite well, congrats!) you could wonder if the best course of action is to just not give it any attention at all.

If you're really bothered by it, find a lawyer that will push the license issue further. You can get your product's name/license in there where credit is due.

Other than that, all you can do is build a better project (product?). It's the nature of the beast in open source... people steal constantly. You built something and were successful enough to have it stolen (at least once).

My previous submission months ago asking for guidance on open source licensing to avoid situations exactly like this: https://news.ycombinator.com/item?id=36327372

In the age of LLM , MIT credit become irrelevant because I could just let AI digest whole repository and let it spit out code that is unrecognizable to yours and everyone can just claim - this code is generated by AI, or they wrote them. AI not gonna give credit at all.

Hey dang, this guy is out here bashing me and spreading false claims; all which have been proved to be false.

Can you remove this post or something please?

I think you have an issue with what open source means. He does mention outstatic in his repo and it seems that your project is one of many he's using. It seems like he's better than you at keep developing/selling the project, you should find a way to benefit from it, for example selling outstatic to his audience.

Edit: just checked the difference in stats of the project and his project is so smaller. I think you are complaining about nothing - soft and hard forks are the norm.

A risk is that this other person will claim to be the original author and sue or otherwise attack you for copying their work. I am not a lawyer, but in your case I would contact one and make sure that I had enough documentation of my authorship to survive a legal claim.

(My experience is in the United States only; things might be different in other countries).

Hey HN,

These claims that op has made have been found to be false. His project uses an Open MIT license, and I forked it like a good OSS community member does.

The main dealer breaker for me not using his code directly within my project was a serious GDPR and data privacy violation that I found on the surface of OP’s code.

https://github.com/avitorio/outstatic/blob/d440f8f53ee559fb3...

There is no disclaimers or privacy polices within OP’s website, project, or readers that say he is collecting analytics data, including sensitive GitHub project details.

Some of my users and customers require ISO2700 and SOC2 compliant solutions, and this was a huge red flag to us.

I contacted OP about it, and other security issues, but he blew me off and turned to trashing me online like this.

What do you think?

At lest now you learned not to use MIT license.

What damage is this person causing you exactly?

Tell HN:

It seems to me that they forked your (MIT-licensed) project and are now more successful than you at marketing it and getting contributors. Yes not giving credit to you is a dick move, but it isn't a requirement of the license. Words like "stolen" are out of place and just make you sound bitter to be honest. This is just how open source works.