11
Questions about proprietary software in a "mostly FOSS" Linux-based project and app store (piefed.social)
submitted 1 day ago by to c/opensource@lemmy.ml
6 comments fedilink hide all child comments
 

There's an app being presented in a small store with Linux apps, without any licensing information or link to its source code. The package archive contains mostly scripted code, one compiled executable, and this license:

Copyright (c) 2026 .... All rights reserved.

Proprietary software.

Third-party components and assets retain their respective licenses and notices.

There is no additional licenses at all in the whole package, not even in the SVGs that the dev most definitely did not create from scratch.

The app probably pulls in these third party components during runtime, or provides them inside the archive. Short of analyzing every single file in the package I have no idea.

Most of these third party components seem to be pulled from the developers own website (murky), one or two are not, and those are most definitely open-source-licensed, probably GPL.

I raised an issue about transparency requirements in the app store. Not about this one developer - yet.

Most contributors do provide source code and a GPL or similar license, but the app store's policy phrases this as a nice thing, not a must. But there's always been a strong faction that does not care about such things at all. And there's a rising tide of new, mostly LLM-assisted apps that have no concept of transparency, or qualms about stealing code - be it through the LLM or directly.

All in all this is one of those projects that mix FOSS-licensed Linux stuff with proprietary-licensed and closed source stuff in a very unfortunate way.

Is there any sort of legal situation here?

Apart from that - what else would you say about murky ethics here? What arguments can I use to make my point? There's many similar packages up on that store.

Many people suspect that this developer is lying when they say they're not using LLMs for development. Any way to disprove that claim based on the package archive?

While writing this I analyzed the software package in question a bit more and I'm pretty sure I know the answer already, but I'm still asking the question. Maybe I missed something, or maybe there is a legal issue I'm not aware of...

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 8 hours ago

Ok, yeah that sheds some light on the situation. It sounds like you're in a gatekeeper role

I think pushing to force transparency is good, especially if you are getting traction on the issue

I have also found that the software in question wants to install 40 more packages from its creators personal website. This isn't disclosed anywhere. And that is objectively shady af imo - but again, probably not actually illegal.

But this though...That is shady as fuck. Perfectly legal, but that's a huge red flag. There's a very high chance they have some data collection packages in there already, it is a reliable way to make money off free software

It also means the security is "trust me bro". That's far more disturbing to me than all the legal and transparency concerns put together. They may not be doing anything bad yet, but it means they could sneak it in easily later

  • permalink
  • fedilink
  • source
  • parent