Hacker Newsnew | past | comments | ask | show | jobs | submit | more nerdile's commentslogin

I don't have to grant Word a license to what I type in it. This is a highly unusual clause that other software doesn't have.

When software has to "phone home" to deliver the functionality you requested, then two things happen: One, a number of privacy regulations kick in, and they need to get you to agree to send your data to them. Two, they now get to move your data out of your control. I mean, you trust them today, so here's hoping they don't ever get hacked or hire someone untrustworthy?

It's sad when even to use the basic features of a web browser, you need to agree to send them your data. It's not fundamentally necessary to send your data to Mozilla or their partners in order to load and render a website. It's a dark pattern to obtain consent to collect your data "when it's necessary", and then rewrite your app to make it necessary.


> I don't have to grant Word a license to what I type in it.

Yes you do.

From Microsoft's Services Agreement [1]:

> To the extent necessary to provide the Services to you and others, to protect you and the Services, and to improve Microsoft products and services, you grant to Microsoft a worldwide and royalty-free intellectual property license to use Your Content, for example, to make copies of, retain, transmit, reformat, display, and distribute via communication tools Your Content on the Services.

That's broader than what Mozilla is asking for.

[1] https://www.microsoft.com/en/servicesagreement


Which for the record they absolutely need, for example if you write something in word, click the share button, copy the link and publish it in this forum. Microsoft is now publishing whatever you wrote in the document, and their lawyers want to make sure they are allowed to do that.

Word versions that predate the share button probably wouldn't need the license grant. But since MS likes to limit the number of different licenses it was probably still in there to cover SharePoint and OneDrive


The software license terms for Word and all the other desktop apps does not include such a clause, no. https://www.microsoft.com/en-us/useterms

The Microsoft Services Agreement applies to your use of their online services, like OneDrive and SharePoint, as you say, and there's an explicit consent in the app and a giant off switch there. They employ dark patterns to push you strongly to use their online services, but it's still optional.

It should be readily obvious that choosing to use online sharing or storage features or submit reviews require the data you enter to be sent, shared, or stored thusly...


In that case I stand corrected. Apparently you could use Word without accepting an agreement potentially granting Microsoft a license to what you write.


No offense, I'm aware of how complex laws can be, but... Shouldn't that be obvious? Or do you think you also grant a license to any pen manufacturer to help you write whatever it is that you are writing?


Word isnt a desktop app anymore. Its a service that is also made available via a desktop app. You cant just ignore 365 like that


> Which for the record they absolutely need

"Hey, here are my car keys - can you move my car to a different parking space?"

"I cannot - I do not have a royalty-free non-exclusive worldwide perpetual license to access and operate your vehicle."

I realize lawyers have been wildly successful in making a parody of our societies and legal systems, but permission is implied in clicking the "share" button, it does not require obtuse and overreaching legal language to grant.


So to take your example:

So based on this request: "Hey, here are my car keys - can you move my car to a different parking space?" The parking attendant's gonna drive it like they do in Ferris Bueller's Day Off[1]. Oh - you didn't want that? Well you should have been more specific.

If you are comfortable leaving things ambiguous, that's fine. That's how you get situations where Twitter and Meta are using all of their user content as input for LLMs. Obviously you can stop using those products if you want, but when you get angry about (or mock) companies that are making it illegal for them to do the same thing you are part of the problem.

I don't "like" legal jargon, but I understand that the legal system is one way we can limit the power of corporations, and throwing up your hands and claiming we don't need it feels immature to me. We live in hell but that doesn't mean we shouldn't try to improve hell. We certainly shouldn't lie & distort what rights Mozilla has under this agreement as the title of this submission does.

[1] https://www.youtube.com/watch?v=c0_rKOlzVuY


> Oh - you didn't want that? Well you should have been more specific.

But that license agreement does the opposite - it gives Microsoft more general permissions. You tell them to host & share your content by clicking "share", but then they also give themselves all sorts of other permissions.


I don't know that I agree I guess? I think when they say they have the right to "make copies of, retain, transmit, reformat, display, and distribute via communication tools Your Content on the Services" - that basically describes sharing your content? They copy your content, they transmit it to their service, they retain the copy, they reformat it for another context, they display & distribute it - all on "the Services."

Like what in there is "more" than you need to share an item? I certainly see how they could add more text restricting the nature of the license to be in line with user intent - but that feels like it goes against that it's "implied." Which is it? Is it obvious what rights Microsoft needs to share content or should they go into more excruciating legal detail?


(I do agree with you that the post title distorts the Mozilla license, for the record)

> I think when they say they have the right to "make copies of, retain.." - that basically describes sharing your content?

It does. But that is not the rights they granted themselves - they start that list with "for example". The actual rights they grant themselves are:

> To the extent necessary to provide the Services to you and others, to protect you and the Services, and to improve Microsoft products and services

That is all MS products and services. In other words, they grant themselves exactly the right to train AI on your content, that you had used as an example of the consequences of vagueness.

To move beyond this specific license - when an entity wants to do with your input only what you implicitly tell it to do (send a search query to Google, host & share a document, etc.), they already have all the permissions via implication. It is when they want to do more, that they need a license.


Oh! I am the asshole here. I was relying on the quote in the thread but you are right that the full license is far too broad!

> when an entity wants to do with your input only what you implicitly tell it to do (send a search query to Google, host & share a document, etc.), they already have all the permissions via implication.

I guess I don't think this is true. If they have a nice broad license that covers what you ask of them that broad license might also allow "improving their services" (you would have to read it). The alternative is what Mozilla does here - putting limits on their use. Legal frameworks aren't...physics? They only matter if you go to court - but once you get to court the thing that matters is the text of the legal agreement. I guess...if you wanted to sue Google over what they did with your search query, the lawsuit would hinge on what their ToS said and it either says they can do what they did or it doesn't?


> Oh! I am the asshole here. I was relying on the quote in the thread but you are right that the full license is far too broad!

Don't feel bad - it was the purpose of those examples to deceive.


My Word 95 never asked for this though? Clearly it’s not necessary to provide me a word processor.

My CS4, as far as I recall, has never asked for it either.

It seems a fairly recent thing that companies want to harvest your personal information.


I went looking for old Microsoft Word EULAs but didn't find any on google. I did find this fun tidbit, though:

> Performance or Benchmark Testing. You may not disclose the results of any benchmark test of either of the Windows 95 Software Components to any third party without Microsoft’s prior written approval.

Wasn't that an Oracle sin? I guess Microsoft didn't want to miss out on the dickery.


A license grant like this is common in the context of review systems or forums or the like. For example if I go to addons.mozilla.org and post a review for an addon, Mozilla arguably needs a license grant like this to allow them to publish the review. And preferably they would want to word it in a way that then allows them to use the same review in print or a super bowl spot.

The weird thing is that a) I don't think this license grant covers any of that, since publishing a review doesn't improve my experience, it improves other's experiences, and b) Mozilla Websites like addons.mozilla.org have a completely different TOS [1], with a completely different license grant.

I have no idea what this license grant is supposed to accomplish, or what it would even allow that requires a license grant in the first place

1: https://www.mozilla.org/en-US/about/legal/terms/mozilla/


Thinking about this a bit more: the most likely use for this specific license grant I can come up with is a 3rd party partnership similar to pre-acquisition Pocket.

Imagine if on first startup Firefox offers you to show website recommendations. Maybe a prechecked checkbox. If you don't say no, they send anything you type in the address bar to some third party, that third party throws that in a recommendation system and spits out websites you may want to visit, which Firefox then shows in the new-tab page. This license grant would cover that. They would be using a license on content I input (all my keystrokes in the address bar) to help me experience online content (recommendations for new content) as I indicate (they asked). In principle recommending me websites based on all images I upload with Firefox would also be covered, though that's a bit far fetched.

Of course in the EU you'd probably have pretty strict consent requirements because of the GDPR, same with other jurisdictions with strong privacy protections. But in places with weak privacy protections the grant in question should cover all bases to pull something like this


Agreed. Very disappointed that Thunderbird went the direction they did.


He might be seen as presumptuous for already having a pope name and get sunk in the Vatican politics.


Summary: The UK has some Online Safety Act, any websites that let users interact with other users has to police illegal content on its site and must implement strong age verification checks. The law applies to any site that targets UK citizens or has a substantial number of UK users, where "substantial number" is not defined.

I'm going to guess this forum is UK-based just based on all the blimey's. Also the forum seems to have been locked from new users for some time, so it was already in its sunset era.

The admin could just make it read only except to users who manually reach out somehow to verify their age, but at the same time, what an oppressive law for small UK forums. Maybe that's the point.


IANAL

> any websites that let users interact with other users has to police illegal content on its site and must implement strong age verification checks.

But I believe you only need age verification if pornography is posted. There's also a bunch of caveats about the size of user base - Ofcom have strongly hinted that this is primarily aimed at services with millions of users but haven't (yet) actually clarified whether it applies to / will be policed for, e.g., single-user self-hosted Fediverse instances or small forums.

I don't blame people for not wanting to take the risk. Personally I'm just putting up a page with answers to their self-assessment risk questionnaire for each of my hosted services (I have a surprising number that could technically come under OSA) and hoping that is good enough.


I believe you only need age verification if pornography is posted

But if you let users interact with other users, you're not in control of whether pornographic material is posted, so it's safer to comply beforehand.

I commend you for keeping your site up and hoping for the best. I don't envy your position.


> Ofcom have strongly hinted that this is primarily aimed at services with millions of users but haven't (yet) actually clarified [...]

This has echoes of the Snooper's Charter and Apple's decision to withdraw ADP from all of UK.

It is not enough for regulators to say they won't anticipate to enforce the law against smaller operators. As long as the law is on the books, it can (and will) be applied to a suitable target regardless of their size.

I saw this this same bullshit play out in Finland. "No, you are all wrong, we will never apply this to anything outside of this narrow band" -- only to come down with the large hammer less than two years later because the target was politically inconvenient.


I geo-block UK visitors on all of my websites. It's sad but the safest solution.


why? if you're located elsewhere you can literally just ignore UK/EU law. they don't have jurisdiction over you; worst-case scenario is probably them ordering ISPs to block your site.


While the actual risk is minimal, countries do have reach beyond their borders.

For example, if you ever leave your home country to visit a third country, that country could arrest you and extradite you to the country that doesn't like you.

Or they could force any financial institution (or even any company) that wants to do business within their territory to stop doing business with you. The EU probably wouldn't do that, because it's difficult and expensive to get the member states agree on sanctions. The US does it regularly. The UK could probably try, but they have less leverage.


What are the chances that someone who runs a tiny, hobby motorcycle forum is going to be extradited from his vacation abroad for breaking a U.K. law? 0.1%? 0.01%? 0.001%? Less? If we only did zero-risk things, nobody would do anything.


That probability is entirely based on the premise that the extradition treaties that the UK has signed with other countries would NOT follow UK law despite the treaty soley based on the premise of being a political refugee for their free expression. What will likely happen, and what often happens with other countries in the third world, is that 'politically problematic' people are being caught in neighbouring countries only to be sent back based on friendly geopolitics. There's no law for lawlessness. This is what happens when north koreans escape and get caught in china or russia. This is what could happen when you accidently post something of political consequence on a tiny motorcycle website that isn't usually being watched but one angry user could be someone's worst nightmare. Also, gangs of motorcycle enthousiasts havent been the most inconsequential group of people you could have used as an example.


As a US person, living in the US, with a US server, I would have absolutely zero reservations about hosting an online forum that may or may not welcome UK users. Just like I would have zero reservations about going online and blaspheming against a religion (illegal in many countries) swearing (illegal in the U.A.E. & probably elsewhere) or insulting a king (illegal in Thailand).


even the UK surely wouldn't risk the horrible PR of extraditing someone from a third nation because a citizen of a completely different country didn't follow their asinine laws. and were the person in question an American citizen, it'd be a massively foolish move for both the UK and whichever nation worked with her.


I like London and want to visit the city again some day.


What if a large number of brits access your websites from a different country? :-/


It's for 7 million active UK users per month. https://www.ofcom.org.uk/siteassets/resources/documents/onli... - definition on page 64.

That's quite sizeable. How many sites can you name have 7 million monthly active UK users? That's over one-in-ten of every man, woman and child in the UK every month using your site.


Yes, the actual draft doesn't really add many requirements to non "large" services, pretty much having a some kind of moderation system, have some way of reporting complains to that, and a filed "contact" individual. I note it doesn't require proactive internal detection of such "harmful" content that many people here seem to assume, just what they already have 'reason to believe' it's illegal content. Even hash-based CASM detection/blacklisted URLs isn't required until you're a larger provider or a file share product.

It just seems like an overly formalized way of saying "All forums should have a "report" button that actually goes somewhere", I'd expect that to be already there on pretty much every forum that ever existed. Even 4chan has moderators.


This reflects on the individuals choosing to create and proliferate such misleading or hyperbolic framing more than it does on the world that we all live in. In meatspace we usually reject these ideas and ignore the people pushing them.


Amen. I don't understand the problem here. Do something real instead of playing on your phone. (Says me while I play on my phone.)


As a former Windows OS engineer, based on the short statement here, my assumption would be that your programs are IO-bound, not CPU-bound, and that the next step would be to gather data (using a profiler) to investigate the bottlenecks. This is something any Win32 developer should learn how to do.

Although I can understand how "Please provide data to demonstrate that this is an OS scheduling issue since app bottlenecks are much more likely in our experience" could come across as "denying and gaslighting" to less experienced engineers and layfolk


I'm not the original poster, but I ran into something similar late in Win 7 (Win 8 was in beta at the time). We had some painting software, and we used open-MP to work on each scan-line of a brush in parallel.

It worked fine on Mac. On Windows though, if you let it use as many threads as there were CPUs, it would nearly 100% of the time fail before making it through our test suite. Something in scheduling the work would deadlock. It was more likely to fail if anything was open besides the app. Basically, a brush stoke that should complete in a tenth of a second would stall. If you waited 30-60 minutes (yes minutes), it would recover and continue.

I vaguely recall we used the Intel compiler implementation of OpenMP, not what comes with MSVC, so the fault wasn't necessarily a Microsoft issue, but could still be a kernel issue.

I left that company later that year, and MS rolled out Windows 8. No idea how long that bug stuck around.


This sounds like you had a deadlock in the painting software code, that would only reproduce under Windows.


That's fine. It's just not open source. Don't call it open source if it's not.

Definition: https://opensource.org/osd


Not everyone agrees with this definition. If the source is open to read, for me it's open source. The website you linked is an opinionated view on what open source is.


> If the source is open to read, for me it's open source

Not everyone agrees with the OSI definition but I'd say almost noone agrees with that definition there.

I think most people understand what you are describing as "Source Available". Could even be a commercial project.


> If the source is open to read, for me it's open source.

That’s called “source available”. Open source colloquially implies open license.


It's not. Open Source has its own definition.

You can define however you want, but it's not Open Source. What you mean is "source available".


I mean, there's not a lot we can do to stop you using the phrase in this way. But you should know that you will cause confusion. The phrase "open source" is, to an awful lot of people, a technical term with a specific meaning and has been so for decades now.


I think you misunderstand the debates happening around open source. They exist, but not for what you mean.


This reminds me of the discussion of whether if open source AI models are open source or not, when the training data is not available to the public.


I mean this lists MIT license as opensource license, when it's clearly not, because it doesn't at all mention source code. The license just talks about "software".

Anyone is free to publish only binaries+docs under this license, if they wish.

So the website is not very accurate.


that definition is wrong, really by just common sense


This is a shallow dismissal, which is against the HN Guidlines.


>Free and open-source software (FOSS) or free/libre and open-source software (FLOSS) is openly shared source code that is licensed without any restrictions on usage, modification, or distribution. Confusion persists about this definition because the "free", also known as "libre", refers to the freedom of the product, not the price, expense, cost, or charge. For example, "being free to speak" is not the same as "free beer".

I generally think of open source as where I can see the code and freely modify it, not necessarily freely commercialize it on my own.


I think I'm about where you are in all this, I see NC (restrictions that activities are non-commercial; like CC-NC) as being 'open source'.

Sure, I can't take your work, cut you off, then sell that work as if it were my own... but without explicit encouragement to do that (*), honour should inhibit that.

(* I'm aware some licenses give explicit encouragement to commercially exploit -- I just don't think that is the boundary for open source)


the FSF/OSI are big on emphasizing that "free/open" means more than exposing the designs and mechanisms; it means guaranteeing certain freedoms and rights to the users of your software.

what you're describing is usually called "source-available".


If open source doesn't specify a license that is it under then you should only assume that the source has been made available. Both GPL and Apache licensing are considered open source, even though apache is more permissive for commercial derivatives. No one calls GPL "source-available" in common conversation regardless of OSI's opinion.


As well as some variants of BSD licenses: https://en.wikipedia.org/wiki/BSD_licenses

>Two variants of the license, the New BSD License/Modified BSD License (3-clause), and the Simplified BSD License/FreeBSD License (2-clause) have been verified as GPL-compatible free software licenses by the Free Software Foundation, and have been vetted as open source licenses by the Open Source Initiative. The original, 4-clause BSD license has not been accepted as an open source license and, although the original is considered to be a free software license by the FSF, the FSF does not consider it to be compatible with the GPL due to the advertising clause.


"Unfortunately, it was later removed from the app stores."

Sure sign of a trustworthy middleware author


I also have no idea what sarahah was. But I used a search engine and read about it. It took about 30 seconds to understand why the author is using his app as a reference. It was wildly popular for a while but was used in a way that the mighty duopoly of Google and Apple disliked, so it got removed.


No platform should facilitate targeted anonymous messages; that’s one thing we’ve for sure learned about social media, in part thanks to Sarahah. It should be noted that the reason Google and Apple “disliked” it is that hundreds of thousands of their customers petitioned to have it removed. Those people were mostly parents whose kids were getting bullied anonymously.


anonymity brings many challenges indeed. with regards to the petition and what's commonly shared in conventional media, we have proved to Apple that it's based on a falsified case that our filtration system doesn't allow, the removal's story is rather complicated and not justified and many other anonymous apps were allowed, what we were told after clarifying this to Apple was: "executives requested the removal". Anyhow, this is no history and we surely learned many lessons from sarahah an interesting fact is that sarahah's original idea was inspired by my boss's request for feedback, and the early version of owlears was just that (anonymous feedback in the workplace) Thank you


> No platform should facilitate targeted anonymous messages;

Isn't this basically all social media? Or just the internet in general? It's pretty trivial to do on any platform I can think of.


Most social media requires some identifying details to make it difficult to cyberbully someone without recourse. Sarahah did not. A lot of young people suffered because of Sarahah


Is it really difficult though? You need a phone number but that's about it which in US doesn't even require presenting an ID right?


Thanks for the explanation; i had never heard of it before this thread.


that is very helpful, perhaps I didn't take into consideration that many people digitally active today don't know about it. thanks for sharing this


It was a knock-off/copy of apps that pivoted or shut down in previous years(circa 2015) for the same reasons. They simply failed to take the lessons learned from apps like Secret, Yik Yak, and Whisper about facilitating wanton anonymous post on the interwebs


can you please tell me more what trustworthy middleware author mean? (I didn't get it, sorry)


Glad to see someone else had the same reaction I did. There's no need to shout.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: