Relicensing OpenSSL [LWN.net]

Relicensing OpenSSL

Posted Mar 25, 2017 8:52 UTC (Sat) by tialaramex (subscriber, #21167) [Link]

Undoubtedly, I do not recommend this process as ideal for software like OpenSSL. I was just pointing out that a court may not be as exercised about it as the grandparent suggested, because this is actually something they've seen before in copyright cases.

Relicensing OpenSSL

Posted Mar 25, 2017 16:05 UTC (Sat) by fw (subscriber, #26023) [Link] (16 responses)

Most open source software has this question mark over it because it is written by people who have a day job. The employer may not have effectively disclaimed copyright, and the employee could lack sufficient authorization to contribute.

There have been occasional setbacks due to this, but in practice, it does not seem to matter much. And there is really nothing you can do about this.

CLAs are not a complete solution because they still require substantial research to validate that the signature is valid and the signer is in fact authorized to sign such documents, things which are very difficult to do across jurisdictional boundaries. And even if you did your research, the contribution may have been lifted from StackOverflow.

Relicensing OpenSSL

Posted Mar 25, 2017 23:44 UTC (Sat) by lsl (subscriber, #86508) [Link]

It's not even restricted to open source software. The same "code lifted from random Google search results" situation occurs with proprietary software, too.

Relicensing OpenSSL

Posted Mar 26, 2017 20:39 UTC (Sun) by mirabilos (subscriber, #84359) [Link] (14 responses)

That's only in some countries though. In civilised countries like Germany, the employer has no stake in anything employees do in their spare time, period.

Relicensing OpenSSL

Posted Mar 27, 2017 1:06 UTC (Mon) by oshepherd (guest, #90163) [Link] (13 responses)

On the other hand, a German citizen can't really put some code under the (for example) GPLv3+ (because in doing so they're essentially giving the FSF consent to relicense their code - which German law does not permit). Swings and roundabouts.

Relicensing OpenSSL

Posted Mar 27, 2017 1:35 UTC (Mon) by mirabilos (subscriber, #84359) [Link]

That’s wrong.

Of course I can put a work under multiple licences. I can enumerate these (say dual-licence MIT and CC-BY)
or use a criterium (say, anything the OSI has ever approved), and this certainly
does include not-yet-released future versions of existing licences.

Now, whether I *want* the FSF to be able to put out licence terms I wish to use
for my work without further review is the other question, but that’s independent
of the legislation I work under.

It’s not the FSF that does the actual licence grant, it’s just me.
I could let the FSF dictate the terms (by using GPL-vˣ+) or not.

There’s something in German law that prevents me from completely giving up my rights,
and something about being able to reclaim licences after thirty (IIRC) years,
but that only applies to exclusive licences, which OSS licences aren’t
(meaning I can still decide later to put another set of terms onto some work,
which is precisely not possible if it’s in the public domain).

Relicensing OpenSSL

Posted Mar 27, 2017 1:39 UTC (Mon) by andresfreund (subscriber, #69562) [Link] (11 responses)

> a German citizen can't really put some code under the (for example) GPLv3+ (because in doing so they're essentially giving the FSF consent to relicense their code - which German law does not permit).

I don't think that's correct. You can't sign copyright away, but you can very well allow somebody else to sublicense rights. You can grant both exclusive and non-exclusive rights of use, including the permission to sublicense.

Relicensing OpenSSL

Posted Mar 27, 2017 12:02 UTC (Mon) by anselm (subscriber, #2796) [Link] (10 responses)

The confusion comes from the fact that German law does not have the concept of “copyright”, and that makes it difficult to talk about the German situation using Anglo-American legal terms.

What we do have is Urheberpersönlichkeitsrechte (author's personal rights or “moral rights”, such as the right to be acknowledged as the author of a work) and Verwertungsrechte (rights to exploit a work). You can assign a right-to-exploit (e.g., to make copies of a book for sale) to a third party (either exclusively or non-exclusively) but you can't sign away your moral rights. Also in Germany you don't get to deliberately put your work into the “public domain” except by dying (in which case the work will enter the public domain 70 years later).

Relicensing OpenSSL

Posted Mar 27, 2017 14:54 UTC (Mon) by epa (subscriber, #39769) [Link] (8 responses)

Neither the Berne convention nor EU law has the concept of "copyright"?

Relicensing OpenSSL

Posted Mar 27, 2017 15:08 UTC (Mon) by Wol (subscriber, #4433) [Link] (6 responses)

Why should it? The two main thrusts of Berne are that *all authors are treated equally*, and *protection lasts a minimum of 50 years*.

So long as Germany protects "commercial exploitation rights" for 50 years, and it applies to all works equally, then that should be good enough for Berne.

And let's compare the US and British versions of copyright - there are massive differences. I believe there are some works written maybe 200 years ago which are apparently still protected by British copyright. Pepys wrote his diaries in the 1660s, but copyright started, I believe, in the late 1800s?

aiui, the copyright clock in America starts ticking the day the work was written. In Britain, however, the clock starts ticking the day the work was published. So, for example, Pepys work was published some 200 years after it was written so that's when the British clock started ticking. (Dunno how British law copes with works being published by someone who is not the lawful owner/rightsholder ...)

Cheers,
Wol

Relicensing OpenSSL

Posted Mar 27, 2017 23:28 UTC (Mon) by k8to (guest, #15413) [Link] (5 responses)

Nitpick: the US clock for older works starts at the publication date, but for post-1977 works begins ticking only with the death of the author. ( http://copyright.cornell.edu/resources/publicdomain.cfm )

What a world we live in.

Relicensing OpenSSL

Posted Apr 11, 2017 10:55 UTC (Tue) by Wol (subscriber, #4433) [Link] (4 responses)

What about sound works? The British clock starts ticking on publication day, and runs for 50 years before it times out.

That's really what I meant - the clock starts ticking when the work comes under copyright. I didn't cover when it times out, for which there are a whole bunch of assorted, crazy rules.

Personally, I'd like to see a system similar to the old American one where you had to register your work. Probably along the lines of you have a standard copyright statement eg (for Discworld) it would be "(C) Terry and Lynne Pratchett", along with the publication date. That copyright statement would be in a registry, so that any work that they had written would have that statement in it, and anybody could look it up in the registry to find contact details, copyright expiry details, etc etc. And it means one entry would cover pretty much an author's entire corpus - save on space and hassle :-)

Okay, what happens if somebody unlawfully strips the copyright statement? Well, that's not much different from the current situation where governments are trying to say "if you find it on the web you can forget about copyright" even when the author has stuck a copyright statement in the work!!!

Stuff where you can't trace the copyright holder - ESPECIALLY if the details in the registry are wrong! - should be a pretty effective defence against infringement.

And after ten or so years copyright should have to be actively renewed. In return for getting rid of the Mickey Mouse Copyright Extension Act, I'd be quite happy to say that - for a fee - copyright could be extended indefinitely. For most works the fee wouldn't be worth it and they'd fall in the Public Domain pretty quickly :-)

Oh - and get rid of the German "70 year copyright extension act" too - it was done to protect the families of soldier/authors killed in the War (dunno which one), and copyright should expire on the later of 50 years published or the author's 120th birthday. That would protect people who die young just as effectively.

Cheers,
Wol

Relicensing OpenSSL

Posted Apr 11, 2017 12:41 UTC (Tue) by mirabilos (subscriber, #84359) [Link] (3 responses)

> Personally, I'd like to see a system similar to the old American one where you had to register your work.

*NO*! I’m *so* glad the Berne convention abolished that.

> Okay, what happens if somebody unlawfully strips the copyright statement? Well, that's not much different from the current situation where governments are trying to say "if you find it on the web you can forget about copyright"

That’s completely wrong.

In Berne convention signatory countries, anything you “find” must be assumed under maximum copyright protection by default; even anonymously published works have a protection of ~70 years from the date of the publication.

Your registration scheme is unpractical and won’t work out; furthermore, it would cause undue burden to creative people who can’t afford registration (think third-world countries, street beggars/artists, etc) or are illiterate (which doesn’t prevent them from being creative and thus the author of a work), so it’s maximum discriminatory.

Relicensing OpenSSL

Posted Apr 11, 2017 13:27 UTC (Tue) by pizza (subscriber, #46) [Link] (2 responses)

> Your registration scheme is unpractical and won’t work out; furthermore, it would cause undue burden to creative people who can’t afford registration (think third-world countries, street beggars/artists, etc) or are illiterate (which doesn’t prevent them from being creative and thus the author of a work), so it’s maximum discriminatory.

Let's be honest; street beggars/artists won't be filing lawsuits over copyright infringement.

Meanwhile, a good counterpoint is that registration was good enough for the US until 1978.

I'd be all in favor of a system that automatically granted copyright for a short period of time (oh, say, 14 years from first publication -- ie the original copyright term in the US) but would require escalating fees for renewal up to some maximum term (say 70 years from first publication or registration, whichever came first).

Relicensing OpenSSL

Posted Apr 11, 2017 13:52 UTC (Tue) by mirabilos (subscriber, #84359) [Link] (1 responses)

> Let's be honest; street beggars/artists won't be filing lawsuits over copyright infringement.

Yet.

But still *you* want to deny them those rights.

> Meanwhile, a good counterpoint is that registration was good enough for the US until 1978.

Well, *only* for the USA, not for the other almost 200 Berne convention signatories, so it is a good data point but showing just how *bad* your suggestion is.

Relicensing OpenSSL

Posted Apr 11, 2017 14:04 UTC (Tue) by pizza (subscriber, #46) [Link]

> But still *you* want to deny them those rights.

And *you* want to deny the entire point of copyright -- Hint: It's to improve the public domain.

Relicensing OpenSSL

Posted Mar 27, 2017 16:50 UTC (Mon) by mirabilos (subscriber, #84359) [Link]

Germany has two different rights (“Urheberpersönlichkeitsrecht” (droit d’auteur) and “Verwertungsrecht” (exploitation rights), the latter being comparable to US/UK copyright) in one law (UrhG, “Urheberrechtsgesetz”), which is usually translated as copyright law.

So you have to distinguish between “copyright” in the US/UK sense, which is a part of the larger “copyright” that’s law in Germany (but with a German name).

Relicensing OpenSSL

Posted Mar 29, 2017 15:57 UTC (Wed) by ceplm (subscriber, #41334) [Link]

This is actually true for most civil law countries (or at least for all I know, certainly French, Austrian, Czech, and Slovak).

Relicensing OpenSSL

Posted Mar 26, 2017 16:18 UTC (Sun) by rgmoore (✭ supporter ✭, #75) [Link]

It depends on the nature and quantity of the code in question. If there's only a small amount of code that's questionable, it's probably more sensible to rewrite it and be done with the problem. If there's an individual contributor who added a lot of code who you can't reach, that's a serious cloud over the project. But if there were multiple contributors who each contributed a small amount, there may be too much code for it to be practical to rewrite the whole thing, even though the individual contributions are small enough to rewrite if one author shows up and complains.