Choosing an open source license (NewsForge) [LWN.net]

This NewsForge article touches on the process of selecting an open source license. "There isn't one answer for all open source projects, according to Lawrence Rosen, the founding partner of Rosenlaw and Einschlag, general counsel for OSI and author of a new book Open Source Licensing: Software Freedom and Intellectual Property Law. "I say, 'Tell me about your software.' There are companies that want to open source some of their [code] and not all of it," says Rosen. In order to advise them, "I have to understand what their product is.""

to post comments

Choosing an open source license (NewsForge)

Posted Jul 26, 2004 22:38 UTC (Mon) by JoeBuck (subscriber, #2330) [Link] (6 responses)

I don't think that Lawrence Rosen, despite his legal expertise, really gets it. He complains that the GPL's "works based on the program" standard is vague, and advocates instead that copyright law be used to define a derivative work. Accordingly, he wrote a license, the CPL, requiring all derivative works to be licensed under the CPL. The result is a vastly more viral license than the GPL! The GPL has a "mere aggregation" exception, the CPL does not.

Why is this a problem?

A CD-ROM is a derivative work of every program and data file on the disk. It therefore appears illegal to bundle a CPL work on a CD-ROM along with any file that has a license that conflicts with the CPL, which includes the GPL together with many other licenses.
In addition, the indemnification language in the license means that any rational commercial distributor should not touch CPL-licensed software with a ten-meter pole. If you're, say, Cheapbytes, you commercially distribute CD-ROMs containing thousands of programs for, say, $5 each. Why should such a distributor be forced to indemnify the software developers? The effect is that, while the original author offers no warranty, the commercial redistributor must offer a warranty against many possible types of mistakes, no matter what a trifling amount of money they charge.

Fortunately, I haven't seen any significant work distributed under this badly flawed license.

The GPL has withstood the test of time, and has been recently upheld as valid by a German court. It's a solid foundation, and Mr. Rosen has not succeeded in improving on it.

Choosing an open source license (NewsForge)

Posted Jul 26, 2004 23:54 UTC (Mon) by hummassa (guest, #307) [Link]

"A CD-ROM is a derivative work of every program and data file on the disk." NO it's NOT.
Search for the definition under USC 17 of derivative works. Brazilian copyright (author's
rights, really) law also classifies separately derivative works and "collection works".
Collection works are NOT derivative works -- the only copyright of the "collector" is the
one over the organization, disposition and selection of contents. Think the OpenBSD CD
license: the software is free software, BSD-licensed, but the layout of the CD is
proprietary... this has legal basis.

Choosing an open source license (NewsForge)

Posted Jul 27, 2004 2:06 UTC (Tue) by kornak (guest, #17589) [Link] (1 responses)

What is this nonsense about "Viral Licensing"? That is a Microsoft description
of the GPL. The GPL is non Viral. This term implies all kinds of negative
connotations. Please refrain from using Microsoft marketing terms. The GPL
is far less Viral than a proprietary lisence where your work can be stolen
and claimed as a derivative work. Nonsense.

Choosing an open source license (NewsForge)

Posted Jul 27, 2004 16:26 UTC (Tue) by JoeBuck (subscriber, #2330) [Link]

The point is that while the GPL is commonly accused of being "viral", Rosen's alternative actually is.

Choosing an open source license (NewsForge)

Posted Jul 27, 2004 7:54 UTC (Tue) by MathFox (guest, #6104) [Link] (2 responses)

I just read the article and it looks like the writer of the article doesn't understand the basic legal issues involved in licensing. Don't blame Larry for this shoddy interview.

Choosing an open source license (NewsForge)

Posted Jul 27, 2004 10:24 UTC (Tue) by kornak (guest, #17589) [Link]

I'm just tired of seeing that term repeated over and over again. It's one
of those cases where if people hear it enough they might start believing it.
The term has already become a part of the common vernacular. I refuse to use
it as it serves no purpose to repeat Micro-speak. I will not use MS jargon
to describe the GPL since it has an insidious, subliminally negative impact
on the language.

Choosing an open source license (NewsForge)

Posted Jul 27, 2004 16:27 UTC (Tue) by JoeBuck (subscriber, #2330) [Link]

No, I do blame Larry, because I have read articles by him where he advocates his theories, and I have read the license texts that he wrote. His advice is a disservice to the open source/free software community.

Choosing an open source license (NewsForge)

Posted Jul 26, 2004 23:24 UTC (Mon) by andrel (guest, #5166) [Link] (11 responses)

There are really only three licenses to consider: X/MIT, LGPL, and GPL. These are the only licenses you can expect developers to have thought about and understand. (And even so, misconceptions about the GPL abound.)

Choosing an open source license (NewsForge)

Posted Jul 27, 2004 2:38 UTC (Tue) by Kope (guest, #21434) [Link] (8 responses)

I'd argue that the BSD is a fairly important open source license as well -- and is arguably more "free" than the GPL in that a BSD licensed product may be taken and made closed source if the user so desires. In a BSD license, the user is free to do what they want. In a GPL license a user is free to do what RMS wants.

Choosing an open source license (NewsForge)

Posted Jul 27, 2004 5:14 UTC (Tue) by andrel (guest, #5166) [Link]

Old-style BSD has the onerous advertising clause. New-style BSD is essentially the same thing as X/MIT, but said more verbosely.

What's RMS got to do with it?

Choosing an open source license (NewsForge)

Posted Jul 27, 2004 5:26 UTC (Tue) by gvy (guest, #11981) [Link]

Oh no. It's arguably silly argument: why do developers have to care of some stinky users -- I mean exactly those who seek to "make closed source" out of free software?

You're mixing up my freedom to walk the street at night and robber's "feedom" to approach me and gently/harshly get me ripped.

So *please* don't repeat that horrible nonsense evaporating from uneducated and self-proud BSD (sub)circles -- heck, a child gets it better than seemingly smart people these days! :-(

Don't get me wrong, I'm no Linux/FSF/RMS addict (rather user of the product/works/concepts) -- I'm just so bored with folks who can see only one level through when the next one is so obvious but still spreading this FUD...

Choosing an open source license (NewsForge)

Posted Jul 27, 2004 12:09 UTC (Tue) by Wol (subscriber, #4433) [Link] (4 responses)

In a GPL license a user is free to do what RMS wants.

If that's the case, why does the GPL explicitly state that "it places NO restrictions on the end user, indeed it is irrelevant to the end user"? (my paraphrase, but RMS's intention and meaning)

Cheers
Wol

Choosing an open source license (NewsForge)

Posted Jul 27, 2004 16:29 UTC (Tue) by JoeBuck (subscriber, #2330) [Link] (3 responses)

The GPL permits a very profitable business model that RMS does not approve of: dual GPL/proprietary licensing. That is, a user of a library can accept the GPL or else pay money for the privilege of using the code in proprietary software. TrollTech, the makers of QT, have become a profitable company based on this model.

dual license model is "rms ok"

Posted Jul 27, 2004 17:44 UTC (Tue) by coriordan (guest, #7544) [Link] (2 responses)

RMS approves of the dual license business model. But Trolltech only use that model for *some* (most?) of their software. Some of their software is exclusively proprietary.

Sorry I can't provide the reference, I'm running out the door as I write this. I think he spoke of this in a previous LWN.net interview. In the interview he endorsed both the MySQL and the Trolltech models, but in a follow up he clarified that hadn't known that the trolltech model was different to the MySQL one, and he retracted his endorsement.

dual license model is "rms ok"

Posted Jul 28, 2004 4:06 UTC (Wed) by JoeBuck (subscriber, #2330) [Link] (1 responses)

Nope. He reluctantly accepts it as useful, but he believes that proprietary software is always wrong (I disagree with him on that).

if you need the reference:

Posted Jul 28, 2004 13:58 UTC (Wed) by coriordan (guest, #7544) [Link]

RMS says: ``I think it is acceptable to do what MySQL AB and TrollTech do: release under the GPL, but sell alternative licenses permitting proprietary extensions to their code. My understanding is that all the code they release is available as free software, which means they do not develop any proprietary softwre; that's why their practice is acceptable.''

Below that paragraph is: ``(Footnote: RMS added later: "I later learned that TrollTech does develop proprietary software. I apologize for having mentioned it erroneously.")''

Choosing an open source license (NewsForge)

Posted Jul 27, 2004 21:34 UTC (Tue) by khim (subscriber, #9252) [Link]

Oooh... not again...

If you'll count "freedoms" then GPL is actually offer one very important freedom to use: ability to combine.

Basically both BSD and GPL encourage forks - and that's good things in short term. It's good to see Inkscape go in different direction from Sodipodi and it's good to have FreeBSD/NetBSD/OpenBSD diversity.

But! Over time with BSD-originated code all you can see are endless forks and branches - very few large-scale fusions. The only way to fuse something is to induce large scale riot when X/MIT (or BSD) license freedom is used (think about X11R6 and later XFree86 history if you need sample). With GPL fusions are trivial: when it's feasible to fuse/or borrow code you are always free to do so - no need for large-scale campaigns or active license patrols (yes, you always need to check code you fuse borrow but with BSD-originated projects you also need to track changes in licenses and act not when you really need to fuse/change something but way in advance - when this or that subtle change in licensing makes future fusions impossible.

So balanse is following:
BSD: the end user gets "right to screw" - executed countless times and almost always with disastrous results (X11R6, Xfree86, countless local *BSD dialects without support and wirthout sources, routers with forever unpatched security holes and so on; sometimes a lot of pressure from end-users prevented wide-spread harm, sometimes not)
GPL: the end user gets "right to combine" - executed countless times as well and always with good results for end user since even if end-user is not active programmer there are others who can do programming for him (Sveasoft's ROM for WRT54G, a lot of different ROMs for Zaurus and so on)

So with X/MIT (or BSD) you exchange valuable (for end-user) right for other right - mostly useless for end-user (who, after all, is end user and not interested in software reselling) and usefull really only for quick bucks of middleman...

Now please explain to me once more how exchange of valuable freedom with other useless one gave me more freedom as result. I can not see how but may be it's just me?

Choosing an open source license (NewsForge)

Posted Jul 27, 2004 11:03 UTC (Tue) by zooko (guest, #2589) [Link] (1 responses)

My http://zooko.com/ license_quick_ref.html currently lists "permissive, GPL, LGPL, and MozillaPL". "Permissive" means MIT/old-X/new-BSD/etc. I would be happy to remove MozillaPL from my list since (if you you constrain your considerations to only these five columns) it is overshadowed by LGPL. However, MozillaPL seems to be liked by a fair number of people, or at least it was a couple of years ago when the open-sourcing of Mozilla was new and exciting.

Choosing an open source license (NewsForge)

Posted Jul 27, 2004 16:54 UTC (Tue) by andrel (guest, #5166) [Link]

Well even Mozilla no longer uses the MPL, because they found it did not meet their needs. More accurately, they dual-license MPL/LGPL/GPL. See the Mozilla relicensing FAQ.

Rosen also thinks GPL needs "I agree" click-through

Posted Jul 26, 2004 23:39 UTC (Mon) by stevenj (guest, #421) [Link] (10 responses)

The same author, Lawrence Rosen, also wrote an article in 2002 claiming that "most open source licenses" are "to be interpreted under contract law" and requires an explicit "manifestation of assent" such as a "click-wrap" button.

This directly contradicts the arguments of Prof. Eben Moglen, Pamela Jones of Groklaw, and others that the GPL is a license, not a contract, so that exercise of any of the licensed rights (beyond the copyright defaults) is assent enough. Not to mention the fact that Rosen's 2002 opinion was apparently just contradicted in a German court.

I have to say that NewsForge op-ed pieces such as this one, and recent ones about the GPL's "unintentional harmful effects" and uninformed articles about the patent process leave me with a low opinion of NewsForge's editors.

Rosen also thinks GPL needs "I agree" click-through

Posted Jul 27, 2004 1:59 UTC (Tue) by piman (guest, #8957) [Link] (9 responses)

He's also written many non-free licenses and passed them off as "open source"; unfortunately some of them have found their way into core tools like RPM, making RPM non-free and impossible to distribute (since other parts of it are GPLd).

Rosen also thinks GPL needs "I agree" click-through

Posted Jul 27, 2004 12:45 UTC (Tue) by spot (guest, #15640) [Link] (8 responses)

Wow. Put the Debian koolaid down for a moment. :)

RPM is still very much free. The only component which was in question is elfutils's libelf, which is GPL, not CPL.

Rosen also thinks GPL needs "I agree" click-through

Posted Jul 27, 2004 17:13 UTC (Tue) by piman (guest, #8957) [Link] (7 responses)

No, it's not. elfutils is under the OSL, making RPM a combination of GPL and "OSL" (http://www.opensource.org/licenses/osl-2.1.php). This is not legal to distribute since the OSL is GPL-incompatible. And even if an exception to the GPL is added (making RPM at least legal), the OSL is still considered non-free by Debian.

Rosen also thinks GPL needs "I agree" click-through

Posted Jul 27, 2004 21:18 UTC (Tue) by nealr (guest, #23499) [Link] (4 responses)

piman:

No one except the copyright holder of a particular pieces of software can decide the incompatibility of a particular license with another.

So if I write GPL'd software and chose to include OSL licensed software in it... that it 100% kosher.

RMS's opinon on the matter is 100% irrelevant if I hold the copyright to the GPL'd software. This is basic copyright law, a thirt part can't tell you how to interpret/enforce a license to your own code.

RMS's opinion on incompatibility only matters to software the FSF owns copyright to.

If I remeber right, RPM is copyight Red Hat... so Red Hat gets to decide compatibility w.r.t elfutils.

Of course Debian is free to decide whatever it wishes to for it's onw distro... but you can't claim that something is illegal to distribute if you have no copyrights to the code in question.

Rosen also thinks GPL needs "I agree" click-through

Posted Jul 27, 2004 21:43 UTC (Tue) by piman (guest, #8957) [Link] (3 responses)

No, incompatibility is the function of the licenses and grants involved, not of the copyright holder. But the copyright holder can solve incompatibilities by granting more permissions.

You can write GPLd software and include OSLd software in it. You can even distribute it, assuming you hold all the copyrights. But given the licenses you've granted to other people (GPL one part, OSL another), *they* can't legally distribute it to other people, because following the terms of the OSL violates the terms of the GPL (and possible vice versa).

For it to be further distributable, you need to grant permission to violate the terms of the GPL that conflict with the OSL, or vice versa. It can be argued that your initial distribution is implicit permission, yes, but I and many others find that a legally unsafe position. Therefore, the usual way to do it is with exception clauses, like you find on GPLd software linked to OpenSSL.

RMS's opinion is irrelevant, yes; the license texts themselves are not.

Rosen also thinks GPL needs "I agree" click-through

Posted Jul 27, 2004 22:55 UTC (Tue) by nealr (guest, #23499) [Link] (2 responses)

OK.. I agree with that. It would put other down-the-line distributors in a tenuous position....

But, that is somewhat trumped by the fact that only the copyright holder has any standing to enforce a license, and if they are distributing code with multiple licenses that some pointy-headed lawyer decides conflict in some meaningless way.... the down-the-line distributors have nothing to fear (except their own paranoia) since the copyright holders distributed it themselves. (This was your point... but I would say that you are worrying too much).

It's good practice to put in the exceptions.

Which begs the question of why RMS decided NOT to put an exception in the GPL allowing the 4-clause BSD license to be compatible. I think it was his own hubris and personal agenda.

The advertizing clause is hardly an undue burden. If you are writing a paper and you want to reference another, you must properly attribute it. Same concept. As to why RMS decided that proper attribution is against free-software is beyond me.

Rosen also thinks GPL needs "I agree" click-through

Posted Jul 28, 2004 0:22 UTC (Wed) by piman (guest, #8957) [Link] (1 responses)

It's not just "good practice", it's legally required for the exception to be there if you don't want to be tacitly infringing upon copyright. And the licenses don't conflict in meaningless ways; the OSL is a shitty license, and imposes way more restrictions than the GPL, it's not nearly as trivial as the BSD advertising clause.

> the down-the-line distributors have nothing to fear (except their own paranoia) since the copyright holders distributed it themselves. (This was your point... but I would say that you are worrying too much).

Let's say 5, 10, 20 years from now, Red Hat goes bankrupt. Someone buys the copyrights off of them, and pulls another SCO. Except this time, they actually own copyrights, and people actually are violating the terms of the licenses. Having the exceptions be explicit protects you from this.

As for the rest of your post, you seem misinformed about what the BSD advertising clause actually involves. The 3-clause BSD license is GPL-compatible, and the GPL actually allows you a far more annoying credit option via 2c. The advertising clause (the 4th clause, if you find an old copy of the license) is about advertising, not about credit. It's also thought that it's probably not legal to include in a copyright license, since it affects entirely unrelated works.

Rosen also thinks GPL needs "I agree" click-through

Posted Jul 28, 2004 0:25 UTC (Wed) by piman (guest, #8957) [Link]

Actually, I'm wrong; it's been so long since I've seen a 4 clause BSD license that I misremembered the numbering.

In a 4 clause BSD license, the 3rd clause is the advertising clause. The 3 clause BSD license is the 4 clause BSD license minus the 3rd clause. The 2 clause BSD license is the 4 clause BSD license minus the 3rd and 4th clauses.

Rosen also thinks GPL needs "I agree" click-through

Posted Jul 27, 2004 21:56 UTC (Tue) by s_cargo (guest, #10473) [Link] (1 responses)

"spot": The only component which was in question is elfutils's libelf, which is GPL...

"piman": No, it's not. elfutils is under the OSL...

It is apparently only relevant what libelf's license is, not elfutils.

http://zgp.org/pipermail/linux-elitists/2004-April/009785.html

Rosen also thinks GPL needs "I agree" click-through

Posted Jul 28, 2004 0:15 UTC (Wed) by piman (guest, #8957) [Link]

I just downloaded the source to RPM from http://download.fedora.redhat.com/pub/fedora/linux/core/2/SRPMS/rpm-4.3.1-0.3.src.rpm. (Incidentally, it's very difficult to find RPM 4.3's source, and I couldn't find it at all in non-RPM form.) I also grabbed RPM 4.2 from RH9.

RPM 4.2's libelf is pretty clearly under the OSL; every file in rpm-4.2/elfutils/libelf has an OSL header, and rpm-4.2/elfutils/COPYING is a copy of the OSL. So, distributing Fedora Core 1 infringes on Red Hat's copyright, which IMO is more than enough to justify the "Larry Rosen considered harmful" comments above, and a serious problem on Red Hat's part for not checking licenses before releasing.

RPM 4.3 does not include elfutils/libelf, so I got it separately (again from FC2). Now I find that libelf is licensed under the GPL (hooray). However, other parts of elfutils are licensed under the OSL and link to libelf. So now, RPM is fine; it's just all the rest of elfutils that can't be distributed. The exact software causing the problem has changed, but the nature of the problem hasn't.