End User License Agreements—or EULAs—are a mainstay of the
proprietary software world that tend to rub free software advocates the
wrong way. When a EULA is presented in a click-through window as part of
the initial execution of a program, it can really raise some ire
as Mozilla is finding out. Its plan to present a click-through
license for Firefox 3 on Linux has not met with widespread approval; quite the
reverse in fact.
The issue has been kicking around since at least
last May, when Fedora folks noticed that Firefox 3 builds moved the EULA popup
window from the installer—which Linux folks rarely see—to the
first time Firefox is run. More recently the issue erupted in the Ubuntu
community when a user filed a
that reads, in part:
STARTING UP A CERTAIN 3.0.2 VERSION OF FIREFOX BROWSER MAKES AVAILABLE TO
YOU A VERY CAPITAL END USER LICENSE AGREEMENT. THIS AGREEMENT IS OBNOXIOUS
and largely irrelevant to Ubuntu users.
The predictable outcry followed, mostly because people who are used to free
software have a visceral reaction to seeing a click-through EULA. For that
reason alone it is a poor choice by Mozilla, at least on Linux.
Windows users, who make up a substantial portion of the Firefox userbase, are
generally unfazed by EULAs as they are confronted by them
regularly—generally blithely clicking through with little or no
There are a number of objections to the Mozilla EULA, starting with the current
text of the license. Mozilla Corporation chairperson Mitchell Baker agreed
with the critics of the license text, saying "the most important
thing here is to acknowledge that yes, the content of the license
agreement is wrong." New
license text is now available in draft form, but it still doesn't
address an underlying issue: do we need to consult a lawyer when we install
One of the guiding principles of free software is that it doesn't limit
what "end users" can do with the software, it only limits those who wish
to distribute it. When a page or two of legalese—undoubtedly toned
down from what the lawyers would really like—is presented to a
new user, what exactly are they supposed to do with it? Users have rights
under free software licenses, and it is important that they can find out
about them, but it is fairly rare for a program, or even a distribution, to
require a user to click through a copy of the license.
Mozilla's position is that they need to protect their trademarks as well as
inform users about the web services used to try to detect phishing and
malware sites. In answer to those who think a click-through EULA is
unnecessary—often using Linux distributions as a
It's hard to tell what's "necessary." It's an unsettled area and may
vary across different locales. We've traditionally been more conservative
on this point than many Linux distros.
So far, Mozilla does not seem willing to budge from its requirement to show
the EULA as a click-through agreement. Fedora was able to get a waiver of
sorts for Fedora 9 which allowed shipping Firefox 3 without the EULA while
the projects worked out language they both could live with. In Fedora 9,
Firefox opens to a page
that describes the web services when it is run for the first time.
Some kind of compromise along these lines for Linux distributions would
seem to satisfy most of the concerns for both sides, but other than for
Fedora 9, that solution has not been blessed by Mozilla.
Manager Tom "spot" Callaway has an excellent overview of the history
as well as a nice analysis of the EULA. He
notes that almost of all of the terms in the EULA are either covered by
laws or by the Mozilla Public License (MPL). None of that really matters
though as distributions really only have two choices as outlined
by Ubuntu leader Mark Shuttleworth:
Mozilla Corp asked that this be added in order for us to continue to call
the browser Firefox. Since Firefox is their trademark, which we intend to
respect, we have the choice of working with Mozilla to meet their
requirements, or switching to an unbranded browser.
That is the risk that Mozilla takes; if it is too heavy-handed in what it
requires to call a browser "Firefox", distributions will take the code
without the trademarks and call it "Iceweasel" as Debian has
or "abrowser" which is the Ubuntu equivalent. The Iceweasel "fork" was
Mozilla objected to Debian backporting security fixes into older browsers
without its consent, while abrowser has come about because of the EULA
issue. Given that Linux users were some of the earliest and most
enthusiastic adopters of Firefox, it is truly unfortunate that
many may have to run it under other names.
There is an issue that may be getting lost in the shuffle here as well.
Fedora board member Jef Spaleta has expressed concerns
about how to notify users about web services:
"We" as in everybody doing open source software has absolutely no fraking
idea as to how to appropriately notify users about the services agreements
associated with on-by-default web services. "We" collectively aren't giving
it a lot of thought. "We" have this amorphous concept about the online
desktop experience which is going to deeply integrate web services and
enhance the day-to-day desktop user experience. But that enhancement comes
at a cost..and that cost is the complication associated with "terms of
service" for a vast array of different web service vendors.
Web services clearly bring along a number of additional concerns. There
are privacy issues to consider. In many places, particularly Europe, there
are fairly stringent
requirements regarding data collection and retention that are required to
be communicated to users. How that will be done for free software that use
these services is an open question. As Spaleta points out, Mozilla may be
free software organization that is even looking at the problem.
The EULA mess is a situation that certainly could have been handled better by
Mozilla. One hopes that some kind of compromise can be worked out so that
users aren't poked in the eye with legal documents—that aren't even
valid in many jurisdictions—and distributions don't feel like they
need to fork to preserve their freedoms. Mozilla definitely has some
legitimate interests to protect, but it needs to find a saner way to do
There is hope that is happening as Baker has described in an update
on her blog:
We've come to understand that anything EULA-like is disturbing, even if
the content is FLOSS based. So we're eliminating that. We still feel
that something about the web services integrated into the browser is
needed; these services can be turned off and not interrupt the flow of
using the browser. We also want to tell
people about the FLOSS license — as a notice, not as as EULA or use
restriction. Again, this won't block the flow or provide the unwelcoming
feeling that one comment to my previous post described so eloquently.
More details are imminent, but it looks like this could all resolve amicably.
to post comments)