What is open source?
[Posted November 29, 2006 by corbet]
When the
Open Source Initiative first
set up shop, the plan was to obtain a trademark (in the US) for the term
"Open Source," and to restrict use of that trademark to licenses which were
deemed to uphold open source values. That plan came to an end when the
trademark office turned down the application. Some time later, the OSI
trademarked "
OSI Certified"
instead, but, by then, the momentum was gone. Use of the OSI Certified
mark has been minimal. There is, it seems, little demand for a trademarked
stamp of approval for open source licenses.
That situation could yet change, however, as a crop of relatively new
companies pushes the boundaries of the term "open source." At the top of
the list may well be SugarCRM,
which bills itself as "commercial open source." The company's web site
says "We thought there was better way. Why not write our product in
public and distribute it through an open source license?" Despite
these words, the license created by this company, the SugarCRM
Public License (SPL), is not on the OSI list of open source licenses - and
it's not clear if it ever will be.
The SPL is based on the Mozilla Public License, but it includes (among
other things) some text at the end:
However, in addition to the other notice obligations, all copies of
the Covered Code in Executable and Source Code form distributed
must, as a form of attribution of the original author, include on
each user interface screen (i) the "Powered by SugarCRM" logo and
(ii) the copyright notice in the same form as the latest version of
the Covered Code distributed by SugarCRM, Inc. at the time of
distribution of such copy. In addition, the "Powered by SugarCRM"
logo must be visible to all users and be located at the very bottom
center of each user interface screen. Notwithstanding the above,
the dimensions of the "Powered By SugarCRM" logo must be at least
106 x 23 pixels. When users click on the "Powered by SugarCRM" logo
it must direct them back to http://www.sugarforge.org. In addition,
the copyright notice must remain visible to all users at all times
at the bottom of the user interface screen. When users click on the
copyright notice, it must direct them back to
http://www.sugarcrm.com
These requirements on how the software is to be used are rather intrusive
for what is supposed to be a
free license; most open source licenses do not prescribe the layout of an
application's windows. The folks at SugarCRM, suspecting that the OSI
would not consider such requirements as being free, opted not to ask for
OSI approval at all. But they call their license "open source" all the
same.
SugarCRM's John Roberts makes no apologies
for his license, stating that the attribution requirement is necessary to
keep others from stealing his company's work. He goes on to say:
I hope OSI does not get stuck in the past or it could, and I think
will be superseded by a new open source organization that more
people both developers and users feel represent their real
interests and values.
Attribution is here to stay. If you refuse to acknowledge it, you
are trying to stop change, which will be very hard to do I believe.
Ross Mayfield, representing Socialtext, has also come out in favor of
attribution requirements. He has submitted for discussion a general policy statement on attribution
requirements and the form they can take. It supports a relatively
restrained version of the requirement which might find broader acceptance.
Not everybody buys the argument that web-based applications have a need for
attribution which did not exist for prior generations of free software.
Michael Tiemann says:
Now somehow the argument is being advanced that because somebody
else can grab Software X, run it on their own hardware and offer it
as a service, this is somehow different than being able to download
a compiler from the net, build a new cellphone, and sell it by the
millions without payment to the developers who created such a
fantastic toolkit. I don't see it.
So there are some decisions which will have to be made here. One is: to what
extent are attribution requirements simply a form of proper credit for the
creation of free software? And to what extent are they an attempt to
exercise a sort of proprietary control over software which, as a result, is
not truly free? The SPL requirements on the presence, positioning, and
linkage of logos do not look all that different from the invariant section
requirements in the GFDL - and those requirements are widely held to be
non-free. A programmer who borrows even a single function from SugarCRM's
code base must thereafter make his or her entire application "powered by
SugarCRM," assuming the licenses are compatible at all. It would not be
surprising to see a consensus build to the effect that this requirement
makes the SPL a non-free license.
The bigger question which is being forced by this discussion, however, is:
what does "open source" mean? When the term was first coined, there was
concern that businesses would attempt to use it for licenses which were
decidedly not open. That sort of abuse has not been much of a problem - so
far. But now
we are seeing businesses apply the term to code which, to some people in
the community at least, is not open source. Problems often start small and
grow from there; if some businesses are able to get away with calling
licenses without OSI-approval "open source," others will do the same with
much more restrictive licenses. There will always be somebody who is
willing to test the limits.
What can be done about any future abuse of the term "open source" is not clear,
however. There is no trademark, so there is no legal mechanism available
to shut down such claims. The OSI could attempt to regain control of the
term with a publicity campaign and a stronger effort to push the "OSI
Certified" mark. But the OSI has been largely inactive and out of the
public view for some time, and it is not generally seen as a representative
body. So it is an organization with a relatively small mind share and
relatively small moral authority. It's not clear what the OSI can do at
this point.
(See also: David Berlind's
long article which started the current round of discussion).
(
Log in to post comments)