Hacker News new | past | comments | ask | show | jobs | submit login

Sending legal threats to individual contributors to open source projects is extremely poor form, and reflects badly on both the company that sent them, and the lawyers or law firms who helped them do so. From the perspective of the open-source software development community, this will be perceived as both an attack and a breach of ethics, and the reputation cost is likely to affect WhatsApp's ability to hire and retain developers in the future.

Just saying.




> the reputation cost is likely to affect WhatsApp's ability to hire and retain developers in the future

Have Oracle's attacks on open source software [1] affected their ability to hire and retain talent?

Is there any example where bad behavior by a large organization [2, 3] meaningfully affected its ability to buy the talent it needs?

[1] http://www.wired.com/2010/08/oracle-attacks-opensource/

[2] https://www.nsa.gov/careers/FAQs/index.shtml#isNSA_5

[3] http://en.wikipedia.org/wiki/Smartphone_patent_wars


The answer to both questions is yes. The talent pool and cost of developer talent is significantly impacted by a company's reputation, including it's activities in the free/open source arena. Also, your question include a false presumption in "buy the talent it needs", every software company seeks to optimize talent/cost, it doesn't simply have a binary "needed quota filled." Perhaps it doesn't affect it enough yet for them to rationally stop their nasty behaviour, and that is a better question.


Oracle can hire the best developers money can buy. Others, with a better reputation will hire the best developers money can't buy.

That makes a huge difference.



I was recently looking at finance job ads for programmers and the one thing that set the ads apart from 100% of the ads from the companies we all read about here was that they didn't say "competitive salary." They said, "extremely high salary."


I noticed that too. I won't say I'm oblivious to the possibility of a much earlier retirement, but leaving my current job, one I really love, will take more than just that.


Sure, but you could do finance for a short time and then go back to riskier startups, which is the thing I was trying to illustrate with my comment: finance companies appear to be much, much more confident in their viability, or at least are willing to demonstrate their confidence in having a future.


Absolutely. I have categorically declined all recruitment e-mails from Comcast. There's no way I would work for them unless I was starving. I hope the rest of you feel the same...


Speaking of Oracle - I bet they have no problem to hire people. But reputation affects what kind of developers you get. I believe this might affect company's destiny.


For one, Microsoft. And would you argue that the NSA has seen no meaningful reduction in access to talent?


How can you make a meaningful argument either way without access to NSA's actual hiring data?



That article says the NSA is a bit worried about recruitment problems, but hasn't seen any yet. It also says that increasing salaries at SV companies is a far greater challenge in recruiting than reputation.


That's because they know the backbone of their organization is training people NOT to talk about what they are actually doing, nor the implications of those actions.


Hm? It's easy to make a meaningful argument without raw data. You just extrapolate from what you know.

I know that I have had the opportunity to apply to work at the NSA. When I was looking for job opportunities after college I perused lists of government jobs, including positions at the NSA. I know that today, I would not apply to work there. I'm one person, but I know many engineers of a similar mindset and read about many more, so I assume it's a trend. I definitely don't know what rate of potential applicants conform to this mindset, but I know some do (me, the people I know like me, and voices I've heard on the internet).

Therefore, I can meaningfully argue that they would have a harder time hiring. Of course I might be wrong but that's what you get when you operate with incomplete data.


Just to play the devil's advocate, one might just as easily argue that the self-selecting of you and your like-minded peers actually made the NSA's recruiting tasks easier. If you have some moral / ethical / rational belief systems that are inherently incompatible with their organizational DNA, a perfectly efficient recruiting machine would have sorted you into the "NO" pile anyway. Likewise, people more well-suited (for the sake of making ourselves feel better, we'll call them morally challenged) - might now be more inclined to sort themselves "in." So, they might have merely saved themselves some additional interview analysis and (assuming a less than perfect screening process) perhaps even prevented another Snowden Affair. To be clear, I am not asserting that any of this is true, but I suspect that my unfounded speculation using incomplete data is no less reasonable than yours.


Many of us have always had that mindset about the NSA.

However, it takes a special type of odd personality to work there (doing amazingly cool stuff but not being able to talk about lots of it). The personalities that fit there well don't fit elsewhere very well.


> The personalities that fit there well don't fit elsewhere very well.

Source?

I think NSA employs over 30k people. You're going to make a baseless claim that they all share one common personality trait, making them a poor fit for any other possible place of employ, in the whole world?

Really?


Um, yes. Really.

We know, for a fact, that the vast majority of NSA employees are willing to subject themselves to enhanced scrutiny (limited travel), behavioral controls (they will discuss your porn and online accounts), and submission to a fairly arbitrary set of rules (such as polygraph tests) that have no proven connection toward their job or efficacy.

Okay, so, we HAVE demonstrated that NSA employees do share at least one common personality trait that is reasonably unusual in the general population.

Perhaps I was being a bit overzealous and should provide a bit of exception. People who stay with the NSA for very long don't fit elsewhere very well.

Now, this probably doesn't apply to those who don't have security clearances. But then, you're basically claiming that the NSA is just like a standard employer--and that's not normally what people think of when they think of "working for the NSA".


> personality trait that is reasonably unusual in the general population

I'm not sure this part is true. "submission to a fairly arbitrary set of rules" sounds like every job.

> that's not normally what people think of when they think of "working for the NSA".

Most people working for the NSA aren't working as a "Jason Bourne"-type (which is what we think of as "working for the NSA).

I would claim the NSA's very much like a standard employer... but with a (significantly) more heavily enforced NDA.


There's a smaller pool of candidates, but the ones that remain are more likely to be okay with what the NSA does.


This raises an interesting theoretical question:

If you develop a web service and make it accessible from the public internet, what restrictions should you be allowed to place on its usage? And what should the consequences be for individuals trying to bypass those restrictions?


> If you develop a web service and make it accessible from the public internet, what restrictions should you be allowed to place on its usage?

Whatever you want. Public API access =! protected right.

> And what should the consequences be for individuals trying to bypass those restrictions?

Denial of future access by technical means.


I agree if you mean "whatever [technical] restrictions you want".

However, providing the tools that allow instituting legal restrictions is a big can of worms; property rights just don't apply cleanly to client/server communications.


I agree that legal restrictions carry little to no weight in the technical world (I'm not arguing if they should or not, just if the do).

The solution is to require API accounts, which you can then monitor and terminate with prejudice. Tie the account to something unique-ish, or difficult to constantly cycle (SMS? check provider, deny if Google Voice, Twilio, has to be a physical carrier if we're talking messaging client).

The law may eventually catch up to tech. Maybe.


They don't apply cleanly to real property either which is why people who own property have 'people with guns' (gov't technical solution) to resolve any disputes about who's property it is.

Similarly when someone uses a server in a way you don't like you send 'people with guns' to resolve any disputes, because in this case lawyers are believed to be cheaper than changing the server.

This isn't about the ideals of law and power, it's about getting people to stop doing things you don't like, apparently WhatsApp chose a reasonably effective strategy.


In this case they do. When you access my API, you're accessing my server, my property. If I have decided that I do not want you accessing that, it's no different than if I have decided I do not want you on my land.

Not everything is special simply because it's digital.


In a hypothetical world in which SaaS has taken over the market, and 3rd-party clients are forbidden by virtue of license agreements, interoperability becomes impossible.

Imagine if Windows Server had been SaaS; Samba would never exist, Mac OS X and Linux couldn't operate in a Windows environment.

Where property law falls down is when we consider what it is you're selling -- access to a service, or a fully controlled end-to-end service agreement where you assert control over both the client and server.

If it's the latter, does this create a healthy market, or does it create something that could never exist before: the ability to create a "natural monopoly" on an individual customer level. That is, once people are invested in your platform, the cost to compete for that person is so high that it creates a nearly unassailable barrier to entry?

Pre-SaaS, if someone wanted to compete with Microsoft Office, they could invest the effort supporting the Office file format to ease customer transition.

Post-SaaS, if Google Docs, Office 365, et al disallow data/API access to third-party clients, supporting your competitors' existing customers becomes impossible.


If you don't want someone using your API, then return 403 Forbidden. It's more efficient than strongly-worded letters.


It depends on why you've decided. If it's by some predetermined rule that applies the same to everybody, it's probably OK. If it's something like "I didn't like that comment supporting same sex marriage you posted on my blog" maybe not. At what point are APIs considered public accommodations?


So if i have a library that implements your API should that also be illegal?


Though I doubt it'll be a popular opinion, you should only place whatever restrictions you can technically enforce.

Anything else basically ends up a) not working and b) requiring government intervention of one sort or another, eventually, and that harms everyone.


In the non-digital world, you can't enforce that people won't murder each other... should murder not be restricted?


This is an absurd comparison.


I agree. Instead of sending demand letters directly to the open-source developers, wouldn't it be more efficient (and more compliant with the DMCA) to send the demand letter to Github? If the developers are truly at fault, they will have breached the Github terms of service and Github will have a cause of action against the developers.


I think most people realize that this is not an attack on any kind of open source community or a breach of ethics. Further, the unethical ones are those that worked on the project, knowing that it was not their api.

Just saying.


While legally the senders of the C&D letters are right, doing that might be an unwise move. Curbing your developer community in a hostile way may be a mistake in a longer term.

In a longer term, open solutions prevail. OTOH it might be not the moment yet for WhatsApp. Compare the stance of Microsoft in 2005 and 2015.




Consider applying for YC's first-ever Fall batch! Applications are open till Aug 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: