Protecting the open-source license commons

Open-source licenses still matter, he said, even though many people have been downplaying their significance recently. Interest in the community has shifted to other kinds of governance issues, codes of conduct, for example. It is said that today's youth cares little about licenses and has less interest in the surrounding ideology, though he doesn't believe that. There is an increasing level of concern about the sustainability of many communities, and a sense that licenses are not a useful way to define modern open source.

Even so, licenses are still highly relevant for corporate users of open-source software, he said. They are the basic tools that make the whole thing possible. But licenses only matter if they are followed, which is why we are seeing increasing efforts to bring about voluntary compliance, and some increases in enforcement efforts as well.

Enforcement, especially involving version 2 of the GPL, has always been a part of the open-source landscape. It only reached the point of actual litigation in the early 2000s, where we saw enforcement efforts showing up in three broad classes. Community enforcement came directly from the developers, either individually or through organizations like the Software Freedom Conservancy (SFC). Commercial entities have done some enforcement, usually in support of an associated proprietary licensing model. And "non-community developers", such as Patrick McHardy, have been pursuing extortionate actions in search of commercial gain. These are the so-called copyright trolls, though he does not like that term. There has been an increase in all three types of enforcement in the last few years; one outcome has been the SFC enforcement principles that try to distinguish the first two types of enforcement from the last, he said.

A lot of thought has gone into enforcement at his employer Red Hat; Fontana said that enforcement activities should be judged by whether they promote collaboration or not. Enforcement that promotes certainty, predictability, and a level playing field will do that, while commercially motivated enforcement will reduce the incentive to collaborate. So he believes, like many others, that enforcement should not be done for commercial gain. Beyond that, there needs to be transparency around the funding of litigation and the selection of targets. Proceedings should be open; the secrecy built into the German legal system (where much enforcement activity to date has taken place) has not helped here. And, overall, litigation is a poor way to achieve license compliance.

The license commons

Software is a shared resource, a commons that we all benefit from and maintain; this is well understood in the development community. Outsiders do not fully understand that; they often only really learn about it when a disaster strikes, as when an underfunded project is hit by a severe security issue.

Fontana asserted that legal texts are a shared resource as well, even if that may be less obvious. Lawyers share and reuse legal language all the time with no concerns about licensing; that text is just assumed to be in the public domain. Proprietary licenses tend to reuse shared text; end-user license agreements tend not to. But, even with reused text, there is no standard proprietary license; each is unique. So a legal decision may have implications for similar licenses, but the lack of standardization puts limits on those implications. A bad ruling around one product's proprietary license does not necessarily affect other proprietary products.

Open-source licenses are different; they are truly shared licenses, of which there is only a small set. License proliferation has been heavily discouraged over the years, so there is almost no customization of licenses by individual projects. Licenses are shared between communities that may have different policy objectives. There are a lot of benefits to this sharing, including increased certainty and predictability, and the fact that interpretation discussions are not project-specific. But there are risks too, especially when it comes to litigation.

One might think that litigation would increase predictability by creating a body of case law around a license; this view is especially popular among lawyers who lack actual litigation experience. But each case is unique, and cases can have unusual or extreme facts. License interpretations in court will be fact-specific and the resulting decisions will be shaped by the arguments of the litigants — and by judges who are not familiar with open-source licenses. There is little opportunity for the community to influence decisions; all told, there is significant potential for any given case to yield bad results. And, given the standardization of licenses in the community, those results can affect a broad group of projects.

There is, he said, the potential for a lot of litigation to happen, because there are a lot of copyright holders out there. Communities may be stuck with bad decisions as a result. There is no easy solution at hand when one of those decisions comes down. There is, for example, often no license steward who could produce a new version of a license in response to a bad decision, so no license updates are possible. And even when an update is possible, there is a lot of pressure to avoid license revisions, and a difficult path to get a project to accept a new version of a license.

Protecting our licenses

So how can we protect our shared license resources? Fontana said that there can be value to litigation, but he is skeptical of it in general. We should, he said, be advocates for our licenses and look for ways to reduce both the likelihood and the impact of bad legal decisions. Among other things, that implies promoting community enforcement norms. We need to document our license interpretations, refute nonstandard interpretations, and promote modern interpretations that make compliance easier. McHardy, he said, has been trading on some strange interpretations of the GPL that should be refuted. New licenses should be drafted in public and updated more often.

One effort toward some of those goals is the GPL Cooperation Commitment (GPLCC), which seeks to promote community norms for license enforcement. It is based on the idea that licensees with good intentions should not be penalized for mistakes. One concrete step in that direction is extending the GPLv3 termination conditions to GPLv2, since the GPLv2 default is "harsh". This effort started with an enforcement statement put together by the kernel community, but it has since spread well beyond that. Quite a few companies have signed onto it, and more are on the way; it has also picked up signatures from around 200 developers. Efforts are being made to get all GPLv2 or LGPLv2 projects to adopt it; Red Hat now requires it for new GPL-licensed projects.

There have been some criticisms of the GPLCC, he acknowledged. Bruce Perens has said that the new commitment is hollow, since those companies won't enforce the GPL anyway and communities have always given violators more time to come back into compliance. Fontana's response is that companies are normally less forgiving than the community, so the GPLCC represents a change, and McHardy's enforcement was definitely counter to this promise. Bradley Kuhn has complained that the GPLCC has taken only one part of the SFC's enforcement principles, which were really designed to be adopted as a whole. And, according to Kuhn, even the savviest of companies need more than the 30 days given to come back into compliance. Fontana's answer here is that the whole thing is an experiment in establishing a norm that is worth pursuing.

Concluding with a look toward the future, Fontana said that just how license interpretations should be documented is still an open question. The GPLCC group will be looking at other aspects of the interpretation of the GPL with that in mind, and in the hope of preventing future McHardy-like incidents.

Q&A

After the talk, Fontana was asked about the community's work to avoid license proliferation and whether that was, in retrospect, a mistake. He replied that he always thought that proliferation was an overblown concern, and that the community was standardizing on a few licenses anyway. He has not been seeing many new licenses in recent years, though he did acknowledge that companies like MongoDB are trying to change that. The current tendency, though, is to play with the details of standardized licenses — an effort that is driven by the merits of those licenses. Standardization is good, he said, but it does carry a few risks.

Another audience member asked whether the community's interpretation of licenses really influences courts; he replied that, while there is no real evidence of it yet, there has always been an assumption that the courts would pay attention to the community's thoughts. But courts aren't really set up to take outside interpretations into account. The US has a mechanism for amicus briefs, but there are limits to what they can do and it may be harder to express community opinions to courts in other countries.

[Thanks to the Linux Foundation, LWN's travel sponsor, for supporting my travel to the event.]