Saudi Arabia ripped off my open-source app and published it on the App Store

[mhdhejazi]

I developed a Coronavirus tracker app for iOS and macOS and open-sourced the project on GitHub [1]. I tried to publish the app on the App Store, but it got rejected by Apple because it's not from a health organization [2].

Today, I found my app published on the App Store by "The Saudi National Health Information Center", a Saudi government institution, after they made slight changes and additions [3].

[1] https://github.com/mhdhejazi/CoronaTracker

[2] https://www.cnbc.com/2020/03/05/apple-rejects-coronavirus-ap...

[3] https://apps.apple.com/sa/app/corona-map/id1503046302

[paxys]

You can't add a GPL-3 license in your repo (which explicitly allows modification, distribution, commercial use) and then also write "not for commercial distribution" in the README. Pick one.

Even then, it can be argued that a national government publishing an app for free is not commercial use.

[bjelkeman-again]

The GPL 3.0 license afaik does not allow further restriction, like an AppStore imposes.

Details about how the GPL license prevents distribution, for example via the Apple App Store, without a further licensing agreement beyond the GPL license, can be seen here at the Free Software Foundation’s website (FSF wrote the GPL license).

The origin of the notes https://www.fsf.org/news/2010-05-app-store-compliance

More useful detail https://www.fsf.org/blogs/licensing/more-about-the-app-store...

Excerpt from the last document:

———+

Along the same lines, we'll be talking about GPLv2 specifically in this blog post, since that's the license at issue, but this analysis would apply to all versions of the GNU GPL and AGPL. Section 6 of GPLv2 says:

Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein.

This last sentence is a crucial part of the strong copyleft in the GPL and AGPL: it prevents distributors from using separate legal agreements, like Terms of Service or NDAs, to take away the freedoms that the license is supposed to grant. This is the license condition that Apple is violating when it distributes GPL-covered software through the App Store.

[kube-system]

More than that, I's say it's a pretty big stretch to say that a government giving something away is in any way 'commercial use'.

[mhdhejazi]

I'm not concerned about commercial use here. It's about publishing the app without complying with the GPL-3 conditions. It'd be fine had they respected the license and attributed the project.

[kube-system]

https://www.apple.com/legal/internet-services/itunes/appstor...

[diebeforei485]

Contact Apple about this.

https://developer.apple.com/contact/#!/topic/select

[mhdhejazi]

I did. Let's see what they do.

[dependenttypes]

> which explicitly allows modification, distribution, commercial use

But does not allow Tivoization, something that the App store does. This is clearly a violation of the license.

[rvz]

Correct. Next time, the author should just use a strict non-commercial creative commons license with attribution like: CC-NC-A where commercial use is forbidden and the author must be attributed but can also allow remixes or changes.

[wmeredith]

And then what? All this back and forth about license types is farcical. Is he going to sue Saudi Arabia? In what court? It’s a monarchy that tortured and executes people with impunity for personal and political reasons with the support at the highest levels of our government. See: https://en.m.wikipedia.org/wiki/Assassination_of_Jamal_Khash...

[heldrida]

You're absolutely right!

[sandov]

Maybe it would count as dual-licensing it: GPL and an ad-hoc non-commercial license.

[mehh]

First off, looks like a nice app, well done.

So what exactly is your objection? You open-sourced it under GPL, you mentioned they made some changes, have they not open sourced them and thus broke the terms of the Licence, is that what bothers you?

Or is it lack of attribution and notifying you, which would be a decent and respectful thing to do?

What was your actual intention here: 1. Create an app to help the world during this terrible time? 2. Build something you could make some money from? 3. Build something to get kudos from?

As it stood your app wasn't available as Apple rejected it, these guys made it available and thus if your goal was option 1 they helped you!

If option 2, then you failed upon failure and serves you right.

If option 3, I'm not sure you GPL requires attribution within the app, but they do have to open source there changes and thus should make it clear, its built upon your work.

[mhdhejazi]

It'd be totally fine had they respected the license or attributed the project. It's great to know that people use your app and find it useful, and that's why I offered the app to JHU to publish it in their name when Apple rejected it. I'm bothered more by the way the app is published without attribution and how I knew about that.

[pengaru]

Does your app have an About App page or other clearly visible GPLv3 banner containing your name, which they then removed?

[mehh]

That sounds like a fair complaint to me!

[jiveturkey]

how exactly did they not respect the license?

i just don't understand your complaint at all.

[smichel17]

The GPL requires that derivatives (A) credit you, and (B) release their source under the same license.

IANAL but this is not nitpicky legal details; it's the entire point of a copyleft license.

[gojomo]

You could likely ask Apple to take down Saudi Arabia's version as a violation of your copyrights, and a violation of the license under which you offered your creation.

It's the FSF's position that Apple App Store distribution necessarily includes extra restrictions that violate the GPL:

https://www.fsf.org/news/2010-05-app-store-compliance

So, while your "no commercial use" addition itself contradicted the GPL, the GPL itself, if relied upon as the governing license, may give you enough ammo to lodge a complaint.

[orasis]

If this app is providing value to the Saudi people it would be unethical to take it down. We’re talking about lives vs an authors pride.

[gojomo]

There are many other sources for the same info, to satisfy curiosity & impress upon Saudis the urgency of the situation.

Poking the KSA government's public health bureaucracy to better cooperate with others, & honestly acknowledge the work of outsiders rather than stealing it to create a false sense of their own internal competence, might best serve the health of the Saudi people in the long run.

[dependenttypes]

We are also talking about freedom and privacy for the population Saudi people, which extends to lives being potentially harmed - homosexuality is still illegal in Saudi Arabia after all.

[scottlamb]

“I have observed, throughout life, that a man may do an immense deal of good, if he does not care who gets the credit for it.” — Father Strickland

Congratulations on your coronavirus open-source app getting distributed and presumably used! I know it sucks that they didn't credit you or honor the GPL by sharing their modified source, and folks downloading it from a not-exactly-trustworthy government isn't my first choice, but I sincerely offer you my congratulations nonetheless.

[dependenttypes]

I do not think that the quote is relevant to the topic.

[scottlamb]

I meant it as advice—better to celebrate the accomplishment than focus on the lack of credit. The latter leads to stuff like getting Apple to pull the app listing and having no one use it. I'd only do that if I believed Saudi Arabia had made it harmful in some way (eg spyware).

Also, please don't pay attention to the dated/non-inclusive wording ("man", "he"). I tried to just match the original version, although the attribution/provenance is (fittingly, I suppose) a bit uncertain.

[happytiger]

You say here it’s open source, but your licenses read me says it’s ffnc use?

[mhdhejazi]

I published the app under the GPL-3 license, and with a clear statement that says "It's not allowed to publish, distribute the app, or use it in a commercial way". They neither respected the license nor the other conditions.

[skissane]

The GPL3 license allows people to "publish, distribute the app, or use it in a commercial way" (provided that they comply with the other GPL3 conditions, of course). So, when you say it is under GPL3, then say people can't do something which GPL3 allows, you are contradicting yourself.

If you release something under self-contradictory licensing terms, and then people use it in a way you didn't expect – maybe the problem was with your self-contradictory licensing?

[applecrazy]

If I understand GPL3 correctly, they still have to make the modified source available and state the changes they made. The header on GH that parses the license also seems to agree with me: https://github.com/mhdhejazi/CoronaTracker/blob/master/LICEN...

[mhdhejazi]

I see your point here. Maybe I should have modified the license itself and stated that's it's a custom license. But they are still not complying with any of the GPL-3 conditions.

[alain94040]

You can't quite do that. The LICENSE file you put on Git is GPL-3. It's not compatible with the restrictions you are asking for.

And it's not clear that the copy is used in a commercial way. If the app is free, maybe they follow your full conditions?

[lukeschlather]

You can charge money for a GPLv3 app. But you have to provide source code and the tools to build and run your own version of the app to anyone who buys it.

[hncensorsnonpc]

Somebody else said it already. Your "no commercial use" comment is silly and void by making it GPLv3. You cannot have it both ways. You have your point about tivoisation or appstore incompatibility, remove that silly comment from the readme.

[rendall]

Would you mind articulating how they violated your expectations?

[smichel17]

OP has done so further upthread. (Apologies for lack of link, I'm on an app that makes this difficult)

[mhdhejazi]

Some details and screenshots here: https://medium.com/@MhdHejazi/saudi-arabia-shamelessly-rippe...

[zelon88]

Did they abide by the terms of GPLv3? If so then I don't see the problem here. I mean, you deserve an enthusiastic "Thank You" for your contribution to open-source, and I think Apple should reconsider it's determination in-light of our situation and your obvious desire to contribute... but you kinda signed up for this. I would honestly be excited and proud that a nation-state found my time and hard work so worthwhile that they essentially adopted it to benefit a larger audience. I think I would find that extremely humbling myself.

[mhdhejazi]

I see your point about the extra condition I added to the license. And you're right, you can see it as self-contradictory. But when I added it, I wanted to make sure nobody will use the project to make money and thought it's ok to add such a condition above the license.

That said, my concern here isn't the commercial use of the app, they're not doing that. It's about publishing the app without complying with the GPL-3 conditions. It'd be totally fine had they respected the license and attributed the original project.

[dewey]

I understand your frustration but as nobody is making money off this (pretty polished looking!) app and it's maybe potentially even saving lives somewhere you can be proud of your work. Credited or not, it's probably having more impact on the real world than most people's side projects.

Have you written them? Who knows how this came to be, rushed out by some programmer somewhere who doesn't know about the ins and outs of licenses and just wants to get this to as many people as possible quickly.

[Raed667]

The splash-screen (in arabic) says "all rights reserved" with a copyright logo.

And under it lists "the Saudi health council" and "national council for health information".

So my understanding is that they're claiming copyright on this app?

https://imgur.com/a/y6EW8CB

[diebeforei485]

Sounds like you should ask the App Store Legal Team to take it down, because the Saudi Government is distributing your work in a manner that is not compatible with the GPL-3 license - so it is a rights infringement issue.

https://developer.apple.com/contact

[giardini]

Find what you think is a reasonable price, explain to the Saudis and ask them to write you a check. They'll probably do so if your claims are correct and your price sensible. The Saudis are generous people.

[onetimemanytime]

You will probably be contacted by them. Ask for some money, they'll probably pay and call it a day.

P.S. Don't click on any whatsapp link they may send you.

[brudgers]

A software license matters in proportion to wherewithal to lawyer up and enforce the terms...just like any other contract.

[pacamara619]

You used the GPL and then tried to put it on the App Store? The GPL does not allow that and you should know better.

[jamesjamaes]

Negotiate to get credit for the work or cash. You would not have been able to register it. They did it with a change. you found that out. Now you hold them responsible and Negotiate to get credit for the work or cash.

[jamesjamaes]

Negotiate to get credit for the work or cash.

[gojomo]

Create some compelling new features for your version. But include some obfuscated back-door allowing you to insert other messaging later. Tempt the copycats to integrate your improvements, including the backdoor. Then send subversive messaging they wouldn't like, anything from simple credit, if desired, to short utterances carrying the death penalty in their jurisdiction.

(Of course, it's likely too late to pursue this strategy in this case, and one should be careful about such vigilantism against murderous organizations. But I mention this to place it in the "idea library" for other HN readers, who may find themselves in similar situations in the future.)

[s_y_n_t_a_x]

Did they maybe translate it so they could link it to their citizens?

I really see no problem with this, they should provide the source code, but from what you said their modifications really aren't that sought after are they?

Don't open-source something if you don't want someone to clone it. What did you think was going to happen?

I don't see why someone would post the source to an entire app then watch the app store for a clone waiting to complain about it...