<html><head>
<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type">
</head><body bgcolor="#FFFFFF" text="#000000">
<blockquote style="border: 0px none;"
cite="mid:c6be0eb9-d2b5-1deb-8609-968599b3fb87@mozilla.com" type="cite">
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="width:100%;border-top:2px solid #EDF1F4;padding-top:10px;"> <div
style="display:inline-block;white-space:nowrap;vertical-align:middle;width:49%;">
<a moz-do-not-send="true" href="mailto:l10n@mozilla.com"
style="color:#485664
!important;padding-right:6px;font-weight:500;text-decoration:none
!important;">Axel Hecht</a></div> <div
style="display:inline-block;white-space:nowrap;vertical-align:middle;width:48%;text-align:
right;"> <font color="#909AA4"><span style="padding-left:6px">2016
December 14 at 13:02</span></font></div> </div></div>
<div style="color: rgb(144, 154, 164); margin-left: 24px;
margin-right: 24px;" __pbrmquotes="true" class="__pbConvBody">Vendoring
in 3rd party modules has two hard challenges, I think.
<br>
<br>For one, many node modules are in permissive licenses, which is
great on
one side. But there's also the lack of protection against software
patents that'd we'd expose ourselves to. Y'know, the reason our
licensing guidelines say APL instead of something like MIT or BSD.
<br></div>
</blockquote>
Right! The Tofino team noted a related licensing issue in their
Engineering update on Tofino
<a class="moz-txt-link-rfc2396E" href="https://medium.com/project-tofino/engineering-update-on-tofino-8381d82398e8"><https://medium.com/project-tofino/engineering-update-on-tofino-8381d82398e8></a>.<br>
<br>
<blockquote style="border: 0px none;"
cite="mid:c6be0eb9-d2b5-1deb-8609-968599b3fb87@mozilla.com" type="cite">
<div style="color: rgb(144, 154, 164); margin-left: 24px;
margin-right: 24px;" __pbrmquotes="true" class="__pbConvBody">
The other is that we'd effectively vendor code into our bug bounty
program.</div>
</blockquote>
That's a good point that I hadn't previously considered. I suppose it's
true for all our third-party dependencies, including those we're pulling
in from Chrome (with Project Mortar and others). The difference with
Node may be that it's easy to entrain highly-complex dependency graphs
with many modules of unclear stewardship.<br>
<br>
<blockquote style="border: 0px none;"
cite="mid:c6be0eb9-d2b5-1deb-8609-968599b3fb87@mozilla.com" type="cite">
<div style="color: rgb(144, 154, 164); margin-left: 24px;
margin-right: 24px;" __pbrmquotes="true" class="__pbConvBody"> We should
do that very open-eyed, and make sure that we have
the right relationship with the upstream module owner for that to work
out for us.
<br></div>
</blockquote>
Indeed. I suspect we'd need a policy that allows us to vendor
third-party modules only when we're willing to fork them if needed to
maintain them.<br>
<br>
-myk<br>
<br>
</body></html>