11
Questions about proprietary software in a "mostly FOSS" Linux-based project and app store (piefed.social)
submitted 1 day ago by to c/opensource@lemmy.ml
7 comments fedilink hide all child comments
 

There's an app being presented in a small store with Linux apps, without any licensing information or link to its source code. The package archive contains mostly scripted code, one compiled executable, and this license:

Copyright (c) 2026 .... All rights reserved.

Proprietary software.

Third-party components and assets retain their respective licenses and notices.

There is no additional licenses at all in the whole package, not even in the SVGs that the dev most definitely did not create from scratch.

The app probably pulls in these third party components during runtime, or provides them inside the archive. Short of analyzing every single file in the package I have no idea.

Most of these third party components seem to be pulled from the developers own website (murky), one or two are not, and those are most definitely open-source-licensed, probably GPL.

I raised an issue about transparency requirements in the app store. Not about this one developer - yet.

Most contributors do provide source code and a GPL or similar license, but the app store's policy phrases this as a nice thing, not a must. But there's always been a strong faction that does not care about such things at all. And there's a rising tide of new, mostly LLM-assisted apps that have no concept of transparency, or qualms about stealing code - be it through the LLM or directly.

All in all this is one of those projects that mix FOSS-licensed Linux stuff with proprietary-licensed and closed source stuff in a very unfortunate way.

Is there any sort of legal situation here?

Apart from that - what else would you say about murky ethics here? What arguments can I use to make my point? There's many similar packages up on that store.

Many people suspect that this developer is lying when they say they're not using LLMs for development. Any way to disprove that claim based on the package archive?

While writing this I analyzed the software package in question a bit more and I'm pretty sure I know the answer already, but I'm still asking the question. Maybe I missed something, or maybe there is a legal issue I'm not aware of...

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 3 points 1 day ago (2 children)

Thanks.

I have analysed the package to my best abilities - it contains lots of stuff that cannot possibly be 100% the authors creation, but they lie about using LLMs and anyhow AI stealing IP is not illegal (yet).

The community is pretty much 50/50 about LLM usage, but I think more people care about transparency, Opensource and respecting licenses. I'm getting plenty of likes for raising this issue. Well, relatively. More than the people opposing me.

I have also found that the software in question wants to install ~40 more packages from its creators personal website. This isn't disclosed anywhere. And that is objectively shady af imo - but again, probably not actually illegal.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 11 hours ago (1 child)

    Ok, yeah that sheds some light on the situation. It sounds like you're in a gatekeeper role

    I think pushing to force transparency is good, especially if you are getting traction on the issue

    I have also found that the software in question wants to install 40 more packages from its creators personal website. This isn't disclosed anywhere. And that is objectively shady af imo - but again, probably not actually illegal.

    But this though...That is shady as fuck. Perfectly legal, but that's a huge red flag. There's a very high chance they have some data collection packages in there already, it is a reliable way to make money off free software

    It also means the security is "trust me bro". That's far more disturbing to me than all the legal and transparency concerns put together. They may not be doing anything bad yet, but it means they could sneak it in easily later

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] [S] 1 point 32 minutes ago

    It sounds like you’re in a gatekeeper role

    Not sure I like the sound of that.

    But I was thinking of scrutinizing a few more packages in this way, time permitting. Maybe it will inspire other people to do the same.

    It also means the security is “trust me bro”. That’s far more disturbing to me than all the legal and transparency concerns put together.

    Well that's why I'm asking for transparency. This oldest 3rd party appstore ran on "trust me bro" for almost 3 decades... way back when it was big but the whole mobile ecosystem stuff wasn't that developed yet. Then it was small for a long time, now it's growing again because a) a new device came out that is selling surprisingly well and b) vibecoding is here.

    And it was never big on opensource despite being Linux-based.

    Now, when I raise these issues, many of these people feel insulted. Or admit that it's just one bad apple. Not realizing that that's exactly why we need transparency. It's the opposite of "I don't mind Google knowing everything, I have nothing to hide": "you demanding transparency means you suspect us all of being criminals".

    It's idiotic at best, and worthy of a Hamlet quote at worst: "The lady doth protest too much, methinks"

  • permalink
  • fedilink
  • source
  • parent