LWN: Comments on "What's next for Apache OpenOffice"

A look at Oracle might have important lessons to teach...

mathstuf — Sat, 05 Aug 2017 08:51:46 +0000

Kite is a pretty good case study that's recent and fairly well-documented. Replies seem to have gone through a marketing/PR filter and end up just sounding hollow rather than…human.

http://www.techrepublic.com/article/how-startup-kite-trie...

A look at Oracle might have important lessons to teach...

nettings — Wed, 02 Aug 2017 16:29:55 +0000

I was always wondering, given the amazing track record of Oracle to wreck perfectly healthy, ground-breaking open-source projects with stupefying regularity: what is their secret? This latest dung bomb has even had the power to irritate the Apache foundation... Actually, I would love for the combined wisdom of the LWN staff to tackle this question, so that we have a comprehensive list of "how not to do it if you're a company" for posterity. Especially since the interaction between commerce and community is such an important one, and many smaller companies excel at it. I would gladly pay extra for that LWN issue!

Why volunteer?

orcmid — Mon, 19 Sep 2016 15:43:33 +0000

FYI,

Apache, Apache OpenOffice, OpenOffice, and the gull-wing
logo are either registered trademarks or trademarks of
the Apache Software Foundation <http://apache.org> in
the United States and/or other countries.

When there are requests to make use of those marks in various ways, and written permission is provided, a statement such as the above is required for inclusion where permissions are stated in conjunction with the permitted use. Please note that registration is not a requirement although there are values to it in regimes where there are such arrangements. Sometimes registrations are legally transferred but that may not show up until such time as the registration comes up for renewal.

There are such requests for use and there are cases where the producer of a confusing use that would causes confusion is requested to stop and that is usually accomplished, sometimes quickly.

Why volunteer?

thestinger — Mon, 19 Sep 2016 11:03:19 +0000

Note that they don't have a trademark for "OpenOffice".

What's next for Apache OpenOffice

rahulsundaram — Sat, 17 Sep 2016 12:10:04 +0000

Maybe. If someone talks about a bug report, I would like to see them for context.

What's next for Apache OpenOffice

hummassa — Sat, 17 Sep 2016 11:55:27 +0000

A meta-bug-report of sorts? Is there a good chance of it not being ignored? ;)

What's next for Apache OpenOffice

rahulsundaram — Fri, 16 Sep 2016 01:53:31 +0000

Might be useful to post some references to such bug reports. Maybe LO developers can figure out what is going on there and solve it.

What's next for Apache OpenOffice

welinder — Fri, 16 Sep 2016 01:26:26 +0000

Well, your description of LO's handling of bug reports does not match the Gnumeric's developers experience. This is for technical spreadsheet issues -- I have no idea how bugs about other things get handled.

Way too often the lifespan of, say a bug report regarding generation of wrong ods files, is something like this:

1. Report
2. Crickets
3. Auto-generated "is that problem still there?"
4. "Yes"
5. Repeat from 3 until reporter gets tired.
6. Auto-generated close

For accuracy related bug reports, change (2) to a few rounds of "it's floating-point, you don't know what you're talking about".

The above actually isn't specific to LO. I understand that it can be hard to find time to look at all bug reports. What I do not understand is (3): it's basically saying "we haven't had time to look at your report; would you please do some extra work, the result of which we won't look at either". I say "While you're at it, why don't you give me a nice paper cut and pour lemon juice on it? We're closed."

On re-reading, I find I sound too negative. I don't mean to. The point is, with respect to ignoring bug reports I fear that AOO is in the same class as many large and active projects.

What's next for Apache OpenOffice

Wol — Thu, 15 Sep 2016 16:42:51 +0000

> I'd suggest, particularly to those on the LibreOffice side, to work out what you really want and what value does it have to you.

From my point of view, what *I* want is for us LO people to be left alone on our turf to get on with what we want to do.

The problem, as others have pointed out, is that the Open Office name is well known out there, and LO can't afford to let it be abandoned because they will be badly hurt by the fallout. All this fuss about "hand the Open Office trademark over to TDF" is damage-limitation by the LO people.

Cheers,
Wol

Graciousness - Do not become what you hate

Wol — Thu, 15 Sep 2016 16:36:27 +0000

> The stated purpose of this olive branch was to move part of the LO development to the ASF.

And if the developers - you know, the people who write the code - refuse to agree to the Apache licence (as sounds likely), where do Apache go then?

Cheers,
Wol

What's next for Apache OpenOffice

Wol — Thu, 15 Sep 2016 16:28:43 +0000

> Those familiar with the story of King Canute commanding the waves could easily predict the outcome.

Actually, I think those who know the story well would come to the opposite conclusion ...

King Knut was fed up with all his sycophants, so he took them down to the beach and said "Watch how powerful I am!". He knew what would happen ...

Cheers,
Wol

What's next for Apache OpenOffice

Wol — Thu, 15 Sep 2016 16:27:01 +0000

> In hindsight I think the XFree86/X.Org split proceeded relatively painlessly because David Dawes and David Wexelblat were fairly open and frank about not wanting most of the community that had grown up around the code base, even if they refused to openly acknowledge that the license change was their primary means of ridding themselves of that community.

Notably, the community they wanted shot of included the person who had written most of the code over the previous few years ...

Cheers,
Wol

What's next for Apache OpenOffice

Wol — Thu, 15 Sep 2016 16:19:47 +0000

Yup.

egcs forked because there was pent-up developer demand that couldn't get their changes into gcc.

LO (Go-OO) forked because there was pent-up developer demand that couldn't get their changes into Sun Open Office.

Likewise Xorg forked because there was pent-up developer demand that couldn't get their changes into XFree.

So all those projects were vibrant from the start, getting off to a flying start. Unfortunately, AOO is the direct descendant of Sun Open Office, with a reputation for cathedral development and a disinclination for accepting outside help ... :-(

Cheers,
Wol

What's next for Apache OpenOffice

Wol — Thu, 15 Sep 2016 16:15:30 +0000

As I put it, he seems to be a nice person parroting the company line ...

If you want to call it "passive aggressive", then yes, that doesn't sound far off.

I certainly get the impression he is NOT trying to confront the arguments on their merits...

Cheers,
Wol

What's next for Apache OpenOffice

HelloWorld — Thu, 15 Sep 2016 13:16:31 +0000

> I may plan or discuss my funeral (or final wishes), but that does not mean I am dead or dying. :-)
Sure, but it doesn't mean you're not dying either. And AOO clearly is dying, the numbers are unambiguous. Fyi, I am not and never was affiliated to LO or AOO in any way other than as an occasional user.

> Because of this "publicity", the AOO has been overwhelmed by lots and lots of offers of support, which have been graciously and thankfully accepted.
How many lines of code (or translation, artwork etc.) were committed as a result?

> But certainly there is room for other players in this game, and certainly room for one (or more) that are under a permissive license. The thing is is that they don't have to be clones; they can have different audiences, different "missions" so-to-speak.
So what is AOO's mission compared to LO's? I'll quote myself from here: https://lwn.net/Comments/699409/
In order to justify the existence of a fork with that sort of argument you show some feature that
- cannot be implemented in LibreOffice because of technical reasons, or the direction the project is meant to take, or maintainability concerns etc.
- can be implemented in AOO in principle as the reason doesn't apply there
- can be implemented in practice, i. e. there's somebody willing to do the work
Sometimes that is the case, see for instance the fork of DragonFlyBSD from FreeBSD. But for AOO I haven't seen any such reason.

IOW, perhaps AOO *could* have some sort of mission that is distinct from LO's, but I don't see it, and you haven't presented one. If permissive licensing was one, then hordes of ASL2 fans should rush towards OpenOffice right now and commit tons of useful code. But they don't, meaning that apparently they care more about the technical improvements (build system, code cleanup etc.) that LO made. And I don't see any reason for that to change.

> they see how important AOO still is to numerous people
I suppose that depends on your definition of “numerous”. It certainly doesn't have a meaningful amount of developer mindshare, and while it might be important to some users, that is most likely because they know the brand and haven't realised yet that all meaningful development is done in LO.

Anyway, I honestly hope that you'll be able to stop deluding yourself soon. It's dead, Jim.

What's next for Apache OpenOffice

pizza — Thu, 15 Sep 2016 12:05:01 +0000

> But please, continue railing against the dying of the light of the permission Apache license [...]

FWIW, Apache-licensed code is more prevalent than ever -- Witness Android, for example. It's the overwhemingly-preferred corporate "open source" play.

(But outside of Apache itself I'm not familiar with any Apache-licensed project that's not utterly dominated by the corporate entity that created it...)

What's next for Apache OpenOffice

WolfWings — Thu, 15 Sep 2016 11:51:17 +0000

...you're providing plenty of chances for others to correct your historical errors and the FUD you're inventing to propagate, please, do continue.

The sheer level of 'leg in throat' you exhibited with the nginx claim by itself is staggering in how much of a bald-faced and brazen lie it is, trivially debunked in five minutes of Googling.

Especially with the near-zero overlap in configuration or outward-facing components the two projects display would refute it to begin with, and nginx at this point actually being the better of the two for maintaining backwards compatibility in their configuration files w/ the 2.2 -> 2.4 config-file changes that purged major configuration-file syntax components.

So that claim came across purely as trying to claim "Yet another project profiting unjustly by stealing something from an Apache project!" like a fanatic. Note: Being a fanatic is not a good thing. Being fanatical can be, but losing those last two letters is a pitfall.

Apache unfortunately with their long-standing stance on licensing acts more and more like a fanatic with each passing year, and in my line of work as a 'mercenary' Linux Admin (meaning I handle and have on-going access to hundreds of unique environments of various sizes regardless of what components they have; as long as the sites stay functional and the developers can push code changes the clients are happy) I see developers moving from Solr, httpd, Cassandra, and ActiveMQ to Sphinx, nginx, ReThinkDB, and RabbitMQ month after month.

Many Apache projects, while they did build the backbone of the internet, have had a newer generation of services and tools developed that surpass what they offer, usually in features or ease of maintenance/deployment. About the only remaining 'infrastructure level' projects I can think of that Apache offers the only pony in the horse-show is Hadoop, and Tomcat, both of which are only of common use in my experienc ein fairly large environments where you usually have development teams not developers.

But please, continue railing against the dying of the light of the permission Apache license and evil forks that cared more about the end-users than your stigmata. The rest of us will continue getting up every day and getting work done with tools that work, instead of ones that are mostly name-recognition and inertia-based. :)

Why volunteer?

HelloWorld — Thu, 15 Sep 2016 07:27:52 +0000

It's spelled “nicht wahr”

What's next for Apache OpenOffice

nix — Wed, 14 Sep 2016 23:56:17 +0000

Yeah, true; I was mentally misled by the sheer number of moribund Java projects it also has. But it does have a lot of live stuff in that area too...

What's next for Apache OpenOffice

nix — Wed, 14 Sep 2016 23:54:17 +0000

Ah, sorry, I somehow flipped my understanding in the middle of what I was writing, and ended up writing something that made very little sense.

What you said is right.

What's next for Apache OpenOffice

nix — Wed, 14 Sep 2016 23:53:15 +0000

Oh, definitely. No project should be so dead that it can't say it's dead (says I, maintainer of at least three projects which are, uh, not technically dead but I haven't touched them in ten years. Zombie?)

What's next for Apache OpenOffice

oever — Wed, 14 Sep 2016 20:55:00 +0000

Apache has lots of active goodies for Java programmers such as Lucene, POI, FOP, Jena, Tomcat, Ant.

What's next for Apache OpenOffice

andy@barnes.net — Wed, 14 Sep 2016 13:27:40 +0000

Well LO managed to do it. AOO could save themselves some time by forking the current LO as their starting point ;)

I know, I trolled.

What's next for Apache OpenOffice

branden — Tue, 13 Sep 2016 20:42:19 +0000

Perfectly true and well-said, Jim.

Copyright licenses are almost infinitely flexible, but there is a reason we have only a handful of stable points around which FLOSS licenses, as actually used, accumulate. Shifts among these points are meaningful and require effort, not just from the putative owners of copyrights but from the communities around them.

I view both the XFree86 and AOO relicensing decisions as essentially ideological, even though they moved different directions on the permissiveness spectrum.

In hindsight I think the XFree86/X.Org split proceeded relatively painlessly because David Dawes and David Wexelblat were fairly open and frank about not wanting most of the community that had grown up around the code base, even if they refused to openly acknowledge that the license change was their primary means of ridding themselves of that community.

By contrast, AOO proclaimed itself the rightful heir of community leadership, but made relicensing one of the first things on their agenda.

Those familiar with the story of King Canute commanding the waves could easily predict the outcome.

What's next for Apache OpenOffice

bunk — Tue, 13 Sep 2016 19:30:47 +0000

> The reporter only provided their result for AOO 4.1.2.

My guess (that could be wrong) would be that they found the issue while checking which of the fuzzing fixes in LO might be exploitable.

It isn't that uncommon that someone finds vulnerabilities in Open Source software by going through normal bugfixes - until the fix has reached all users, there are still years where it can be exploited if the finder has intentions other than publishing.

> I assume that other descendants of the openoffice.org code base will issue their own advisories as they see fit. I know the patch we published is used by at least one other.

What other direct (not through LO) descendants exist of the AOO code base?

The only area where AOO could have an advantage over LO would be for companies who don't want to use LO for license reasons.

And these descendants should have a financial interest in keeping AOO alive.

What's next for Apache OpenOffice

jg — Tue, 13 Sep 2016 19:08:51 +0000

It was the XFree86 license change away from the MIT license that triggered (the last straw on the camel's back) the XFree86/X.org fork. (From as permissive as you can get to slightly less permissive, but incompatible with the (L)GPL). This would have made many who had mixed code bases more than a bit unhappy, particularly (L)GPL application users.

Fundamentally, changing a license (without active permission/cooperation by those who contributed to the code base) in effect disenfranchises those who invested in the code base under the original terms, and is often very problematic.

Jim Gettys

What's next for Apache OpenOffice

orcmid — Tue, 13 Sep 2016 17:08:24 +0000

> What went wrong with CVE-2016-1513, resulting in even http://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-1513 not mentioning that older LO versions are vulnerable?

The reporter only provided their result for AOO 4.1.2. My mistake was I confirmed that the defect is not in a current release of LibreOffice and did not consider the case of down-version releases that would still be under maintenance.

I did inform [Officesecurity] before our disclosure, but it was very short notice.

To avoid that happening again, we are now always informing [Officesecurity] of pending AOO disclosures of defects that might still matter in that community, and they get to decide whether that is the case or not.

I didn't word the CVE and I have no account for that. The AOO advisory, linked from that CVE does mention the prospect. Of course that doesn't name other products. I assume that other descendants of the openoffice.org code base will issue their own advisories as they see fit. I know the patch we published is used by at least one other.

What's next for Apache OpenOffice

nix — Tue, 13 Sep 2016 16:59:53 +0000

I note that, though your comments are undeniably true and with the exception of a very few projects (Hadoop, HTTPD, SpamAssassin, anything else?) Apache's reputation as a dustbin for moribund projects is surpassed only by SourceForge, jimjag's entire response was a single snide sentence.

It's fairly clear that the Apache Board is doing an excellent job in one area: playing ostrich and denying problems until it is much too late to fix them.

What's next for Apache OpenOffice

nix — Tue, 13 Sep 2016 16:41:57 +0000

Whatever the next release is, you can expect to see any disclosures and advisories related to that distribution at that time and not before.

I'm fairly certain that the existence of a security hole in 4.1.2 is widely known by now. (Far more widely known than it would have been if the bug had just been fixed in a quick point release with an advisory like more or less every other project can manage.)

What's next for Apache OpenOffice

bunk — Tue, 13 Sep 2016 15:55:39 +0000

> I'd say the greatest level of cooperation is with regard to security issues, as it should be.

What went wrong with CVE-2016-1513, resulting in even http://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-1513 not mentioning that older LO versions are vulnerable?

> Minor correction #2: Technically, there was no "license change." Oracle holds the copyright and all code released under LGPL2 is still under LGPL2. What Oracle did was grant a different license to the Apache Software Foundation (not unlike Sun made different license arrangements with commercial producers). The grant to the ASF allowed ASF to distribute the to-ASF licensed code under a license of its choosing, hence the Apache License.

One could say AOO was created with a licensing that makes it impossible for AOO to take code from LO.
(Whether that was done intentionally by Oracle is a separate question.)

The important point is the order of events - no matter how you call it, the problem was introduced by the AOO side months after LO was started.

> Similarly, IBM made a license grant to ASF for their originally closed-source Lotus Symphony code derived from the OpenOffice.org code licensed to them. Indeed, it is only through Apache that any code developed for Symphony finds its way into LibreOffice.

It seems there is/was a lot of politics by Oracle and IBM involved.

I do not see a fundamental reason why IBM could not just have relicensed the Symphony code under the ASL, and then publish it as a tarball somewhere. Less work for them, and the code is in LO a year earlier.

What's next for Apache OpenOffice

alison — Tue, 13 Sep 2016 15:06:06 +0000

nix, point taken, but assuredly indicating that a project is dead would clear up some recurring confusion.

What's next for Apache OpenOffice

orcmid — Tue, 13 Sep 2016 13:57:32 +0000

Minor correction #1: It is inaccurate to say that none of the original developers worked on Apache OpenOffice while it was incubating and later. Of those, a few were even hired by IBM to work on the project. Some contributors to Apache OpenOffice also contribute to LibreOffice (and vice versa), although that is now a small and, I believe, shrinking number. I'd say the greatest level of cooperation is with regard to security issues, as it should be.

Minor correction #2: Technically, there was no "license change." Oracle holds the copyright and all code released under LGPL2 is still under LGPL2. What Oracle did was grant a different license to the Apache Software Foundation (not unlike Sun made different license arrangements with commercial producers). The grant to the ASF allowed ASF to distribute the to-ASF licensed code under a license of its choosing, hence the Apache License. Similarly, IBM made a license grant to ASF for their originally closed-source Lotus Symphony code derived from the OpenOffice.org code licensed to them. Indeed, it is only through Apache that any code developed for Symphony finds its way into LibreOffice.

What's next for Apache OpenOffice

rsidd — Tue, 13 Sep 2016 13:02:59 +0000

Um, I was comparing egcs to LO, not AOO! LO is the project with the different name, the developers and the momentum.

What's next for Apache OpenOffice

nix — Tue, 13 Sep 2016 12:42:45 +0000

The situations are principally not comparable because of the people involved. The egcs split consisted of more or less the entire developer base of GCC, eventually even including GCC's then official maintainer (Richard Kenner): the main change was an experiment with less cathedralic, more open development (public mailing lists, etc). It was a wild success, but was always planned for reintegration, hence keeping up with the copyright assignment and employer disclaimer bureaucracy, GNU coding style etc.

The Apache thing was a corporate code drop and an intentional license change without any of the original developers following along and sort of hoping to build up momentum from there (it didn't). egcs never *had* to build up momentum. On the contrary, a lot of pent-up development effort was immediately unleashed into it. Combine that with the fact that the corporate code drop was more or less unable to incorporate useful amounts of code from the actually living project, and doom was more or less certain from the start unless corporate sponsorship and a pre-made developer base larger than LO's could be found somewhere.

What's next for Apache OpenOffice

nix — Tue, 13 Sep 2016 12:21:56 +0000

There seem to be terribly few 'objective' people around. In fact the only people I know of who have been 'objective' by this standard for lo these many years are people with stakes in AOO not failing. There's a word for that, and it's not 'objective'.

What's next for Apache OpenOffice

nix — Tue, 13 Sep 2016 11:33:41 +0000

You don't want to shut down the git repos and mailing lists of dead projects. Those are historical data and might well be valuable in future. You might not be able to push or post to them, but they should never go away.

What's next for Apache OpenOffice

mina86 — Mon, 12 Sep 2016 10:41:49 +0000

> The FSF won't officially support software that it doesn't have all the copyrights to.

That's not true in general. Whether FSF requires copyright assignment is dependent on a project. Some do require it, some don't.

MPL, not GPL

louie — Sun, 11 Sep 2016 21:22:02 +0000

So the difference isn't even that much.

What's next for Apache OpenOffice

niner — Sun, 11 Sep 2016 16:00:00 +0000

> Historical accuracy and the clarification of the FUD that is being propagated.

You mean like your completely baseless claim that nginx was an Apache httpd fork?

The post confronting you with evidence to the contrary is one of those you conveniently ignore. Well at least it shows clearly what you are really after.

What's next for Apache OpenOffice

seanyoung — Sun, 11 Sep 2016 11:38:16 +0000

I take no joy in AOO not succeeding as well as LibreOffice. I don't wish ill on AOO, anyone should be free to create a fork without fear of abuse. The source code release of AOO is a good thing.

However due to historical reasons the trademark and domain are with AOO and with AOO not succeeding as well as LO, many feel that LibreOffice is the "rightful" place of the OpenOffice brand and domain, and AOO having it damages the brand.

That's not how trademark law works. Wishing ill on the AOO project is not going to make the trademark move and antagonising AOO members is just going to make it less likely. Any schadenfreude is just not helpful.