Link: https://join.piefed.social/2026/08/14/did-piefed-steal-code-from-pylova-lets-look-at-what-happened/

This is my first open source project, apart from tiny bits of code that no one ever paid any attention to. Maybe I don’t know how to do open source properly, maybe I made a mistake here. Let’s find out.

Dear Piefedadmin/Rimu,

Thank you for the effort, marvel, art, you do...

It makes sense the person got upset, but they indeed did not follow the license, considering the header/annotation missing. You did everything right from the point of the license, and considering your time you invest into the works, it makes also sense to follow the license only.

Yet, indeed, when I work at projects at jobs, or something personal, I do tend to leave references in the code as comments (if it's in the middle; or the header, if it's a start of the entire file); in the commit messages, or least pull-requests, though the latter is weaker considering the vendor custom database outsourced. These also help to track down the origin in the history, in case of required:

> /** @see https://codeberg.org/quokkau/PyLova/src/commit/deb4cb2bb9956019dd5c847de03a28d9b9ed45b5/app/community/routes.py#L1115 */

Yet, sure it may increase the source code much... hence commit messages, CHANGELOG.md, or pull-requests to just have a reference in the history of someone's invaluably marvelous life on the miraculous road!

You sure know how it all works, and this is sure not fair to call it "stealing", and especially with no private clarification prior public judgement, I believe...

You publishing this clarification on public highlights your gratitude, respect, and acknowledgement towards other people's effort even more, of course... and is sparkling appreciated...

Meanwhile, I do wish you, and everyone here, safety, stability, and peace...

Best and kind regards

@rimu I took a quick look at pylova and I don't have a good impression from the readme, it's one of those forks that just says we're going to do everything better.

As far as I know their main point of difference is they removed all the antifascist features. Even though they're off by default, lol

Thank you for your kind words.

Coding in public like this is quite vulnerable and does require/assume good-faith engagement from others. There's a huge array of ways to exploit that vulnerability and I've seen many examples of that in the last few months.

It's been really hard.

I don't have an answer but just want to mention im appreciative of the open discussion for those of us who might learn something. From my simplistic knowledge of open source I thought gpl just required providing source and being gpl licensed. I actually though agpl was actually more permissive to be used in propietary software and was mostly supposed to be used with libraries and such.

In mainstream FOSS development, this situation is typically handled with a routine, low-friction interaction where the downstream author opens an issue or leaves a comment on the commit saying:

“Hey, glad you liked the theme! Could you amend the commit to include Co-authored-by: or cherry-pick the original commit so the git history reflects the author?”

The Typical Resolution: The maintainer amends the commit, adds a note to the changelog/commit message, and both projects move on.

The immature way is to accuse the downstream developer of stealing.

I don't understand even a tenth of this - e.g. I don't know what AGPL is, and if someone can make a fork of your code then it makes sense that you can fork the downstream changes too (or not "fork" but... whatever it's called edit: reuse with attribution) - but I just wanted to say thank you for contributing code that we all can use.

You, along with Dessalines, Nutomic, Ernst of Kbin, Jgrim of Sublinks, etc. have all provided alternatives to the immensely enshittified for-profit platforms, which is something really special. So thank you.

AGPL is the standard FOSS license that allows others to copy the code and use it for whatever purpose they wish, with some restrictions, like they can't use the name or branding and they must republish their own source code under the same license.

PyLova's AGPL license displays the copyright notice for PieFed, including claiming the program as copyright by Rimu Atkinson. Rimu, I think legally speaking, you stole your own code from yourself. 😂

Many years ago I was building ROMs for one of the Sony lines of phones on XDA. I saw an interesting feature that had been ported form another Sony line into yet another line. I grabbed the code (only have this guys copyright no GPL mentioned), found the original Sony code (GPL'd) brought it in and attributed both Sony and the porter. I tagged the author of that code in my post on XDA and they lost their shit very publicly that I stole their code - even though it was GPL'd in the Sony repo and they had not kept the GPL intact.

Even if you fully attribute code, some people still don't get FOSS

In reality 4chan is a cesspit of the worst people on the internet and a hotbed of fascism.

I think that crown goes to Xitter now. Hopefully there's detection of Xitter screenshots too. Fuck that place.

Oh it's in the running for second place, but 4chan is way, way worse. /b/ is now just nothing but AI goonbait and incitement for a race war.

4chan has people hiding their identities and being nazi fucks. Xitter has people showing their whole face and location, calling for the death of trans people. Xitter is IMO by far the worst. Screenshots from that place should be banned across the fediverse.

Hahaha I guess so

I have ideas for this. Will let you know if they come to fruition.

Former Twitter decayed info today's X. Its microblogging format has been copied by several apparently non-fascist apps, like Bluesky or Mastodon.

4chan is a most known imageboard and detecting posts from it to delete them will have less collateral damage.

You have confused it with LGPL (Lesser GPL).
AGPL is meant to force site admins to publish source code also to site visitors (as, technically speaking, only an instance admin is an user of software like PieFed or Mastodon)

I assume PyLova’s dev were unsatisfied with PieFed that they forked it. Whether the dissatisfaction was with the code or the dev team I don’t know. It may have contributed to their apparently emotional “we are happy to take from you but not happy to let you take from us” response.

That said, sounds like Rimu did not verify with PyLova devs whether the third party conveyed their thoughts accurately. I don’t blame him; it is a task that takes both emotional and physical efforts. Just perhaps it could have been resolved in a more beneficial way to both parties, e.g. they might have been satisfied if attribution are added to the files themselves.

@rimu@piefed.social, I think from a legal and etiquette standpoint, you were absolutely in the right and the team's reaction seems odd at best. There is the idiom, "Don't bite the hand that feeds you," and I think they had open source forks in mind when they settled on it.

I do wonder though, if from a pure marketing perspective you messaged these guys to convey your admiration of their work. You seemed impressed and they possibly would have liked hearing from you.

To a lot of us Piefed people, Rimu is a Sky Divinity that resides on Mount Pylimpus. We like you particularly because you don't behave like it, so maybe you don't realize yet how much clout you have.

No I couldn't contact them because there had already been so much abuse from them before that, so I'd resolved never to expose myself to them again.

The basic level of trust required to communicate was gone - https://join.piefed.social/2026/08/14/open-source-runs-on-good-faith/

In that situation even copying their code was enough to get them all started up again. I really regret that interaction because it gave them another excuse to stir up trouble.

I meant before you merged their changes.

What you did is not deserving of pearl-clutching but it is a little naive, which is understandable given that this is your first open source project. I will try to explain to the best of my ability as someone who has worked in and contributed to open source projects for 15 years.

A license permits you to use, modify and redistribute code, but it does not allow you to change the ownership of a work for copyright purposes. This is why open source projects will use an attribution header at the top of each source file, so that it is clear which person or entity owns the copyright of that code, and therefore who is the person or entity giving you the license to use it.

When someone forks a project, all of the existing code remains the property (for copyright purposes) of the original author. All of the new code committed is owned by the new authors of the fork. When the authors of the fork distribute their derived work, they are licensing their users to use their work under their own license, while the original code contained in the derived work is still licensed for use by the original author. When both licenses are the same (which they frequently are), this may seem like an academic distinction that's not important.

It is important however, particularly in the case where in the future the authors of the downstream project decide that they want to re-license their project. You can only change the license on code that you wrote, since only the copyright owner has legal authority to license their work. The original (upstream) code in the fork can be distributed under a different license only if that license is "compatible" with the original author's license, and even so the attribution statements and mention of the original license must still be preserved, because that becomes important if the code is to be relicensed a second time under a license which is compatible with the second but not the first license. Distributing code under a different, compatible license does not change the license of the original code or magically change copyright ownership!

The same rules apply when an upstream project incorporates code from a downstream project.

In the event that you use code from a project which does not have attribution headers, it is a requirement that all code that you incorporate from external sources gets attribution headers added to it, so that it is clear to recipients of your work who the original author is and under which license it was given to you (and therefore also to the end-user). Just because source code is FLOSS licensed does not mean that you can copy and paste it as though it's public domain.

This situation does not only occur with forks, but in fact it is a normal situation to deal with in any project that has more than one contributor, since the code of each committer is their own property, and must be licensed by them individually! This is why some open source projects that accept contributions from the wider community will have a Contributor License Agreement (CLA) which assigns copyright ownership of every contribution to the project, and every committer must agree to it. This ensures that the legal entity owning the copyright is the project itself and not the individual contributors, and so in the event that the project desires to relicense the code it can do so without having to retain approval from every contributor in the history of the project.

CLAs have a bad reputation though, as they go against the spirit of Free Software, where every contributor owns the product of their own work. They are frequently used by "faux-pen source" businesses who will start an OSS project with an open license and require a CLA for contributions, then later on when they want to get more investment, sell the company or IPO, they will rug-pull by using the CLA to re-license the project under a non-free business-friendly license that adds restrictions that are not compatible with open-source.

In summary, you can freely use the work of your downstream forks provided that you retain attribution statements (ie. who is the author and what license they provided the work under) or add attribution statements when any are missing. Technically speaking, having that information only in the commit message is sufficient, provided that the version control history is never lost or rewritten, but it is much safer to have the information in the file itself, since this survives all methods of source redistribution (such as tarball downloads etc.)

Hope this helps, and I think you do a fantastic job with Piefed.

That does help very much, thank you!

it is a requirement that all code that you incorporate from external sources gets attribution headers added to it, so that it is clear to recipients of your work who the original author is and under which license it was given to you (and therefore also to the end-user).

Looks like that is the key thing, here. My bad.

for things like themes which are commonly community contributions rather than first-party, i do wonder if having an explicit "contributors" tag on the metadata (or at least a comment on the css file's header or whatever) would be worth it in the future, not just to attribute the person doing the theming work but also for cases like ports of "common" palettes such as catppuccin where someone else did the work of coming up with a pleasant color scheme.

(in case you need A Take, i don't believe piefed did anything malicious in this case. i think attribution is quite important, but in this case it is very obviously a well-intentioned mistake trivially solvable by a gentle reminder that does not seem to be worth all this discourse)

There's no such thing as stealing with AGPL. Mia isn't being very mature here.

thank you. you know I think I saw lgpl and then started seeing agpl without understanding it and thought it was lgpl.

Your bad is that your deliberately tried to remove their attribution and admitted as such when you had a tantrum it didn’t work originally.

Rimu kicked and banned the pylove dev, refusing to speak to them or let them speak.

Rimu was also upset his attempt at taking the code without contribution failed at first.

Rimu took more than themes as well.

Yeah see this is exactly the sort of bad faith bullshit I've been dealing with for months.

https://join.piefed.social/2026/08/14/open-source-runs-on-good-faith/

Yes there's a json file for each theme, we could definitely add metadata like author, etc in there. Thanks!

Thank you very much for the additional insightful clarifications!
May I ask how would proper attribution look like in this case?

Let's assume the license is the same and someone else changed :/pyfedi.py, who should and where would it be correct to append the new contributor name to the current license header?:

# This file is part of PieFed, which is licensed under the GNU Affero General Public License (AGPL) version 3.0.
# You should have received a copy of the GPL along with this program. If not, see <http://www.gnu.org/licenses/>.

Source

I have updated the post with some additional details - the timing of the two commits.

There have been allegations that I did things differently in the second commit because I did the first one, then various things happened, then I did the second one (the one without the attribution they wanted) because of those various things. But we can see from the git history that the two commits are minutes apart and there simply isn't enough time for things to have gone that way. It was one piece of work, done in one session, for the same reasons with the same state of mind.