An Ongoing Discussion of Open Source Licensing Issues
Editor's Note
Rick Moen has been actively keeping TAG updated in an ongoing discussion on open source licensing issues. Starting this month, these messages will be presented on their own page.Microsoft GPLv3 "statement"
Rick Moen [rick at linuxmafia.com]
Sat, 7 Jul 2007 17:55:35 -0700
This is a small excerpt from the discussion thread at Linux Weekly New, in response to LWN's news story about a "statement" posted at Microsoft Corporation's Web site, claiming they are not, and never will be, subject to the provisions of the GNU General Public License v. 3.
LWN is subscriber-supported, and well worth the minor expense.
http://lwn.net/Articles/240822/
*They're involved in the distribution*
Posted Jul 6, 2007 14:31 UTC (Fri) by guest coriordan
Microsoft arranged for Novell to give GNU/Linux to anyone with an MS voucher, and then proceeded to distribute those vouchers. Sounds like distribution to me (with a middle man which isn't legally relevant).
According to the GPLv3 lawyers, they're "procuring the distribution of" GPL'd software, and that requires permission from the copyright holder. So Microsoft are either distributing under the permissions which the GPL grants them, or they are violating copyright.
And, as I understand it, there's no time limit on those vouchers. Novell might have to declare the deal non-applicable (and thus the "protection" too) when they distribute GPLv3 software, or maybe Microsoft will have to make that declaration.
*They're involved in the distribution*
Posted Jul 6, 2007 15:09 UTC (Fri) by guest moltonel
In an eWeek article, they have a quote from "Bruce Lowry, a Novell spokesperson" saying "Customers who have already received SUSE Linux Enterprise certificates from Microsoft are not affected in any way by this, since their certificates were fully delivered and redeemed prior to the publication of the GPLv3".
So it sounds like Microsoft does not plan to be "distributing" GPL code in this manner anymore, and that what has already been distributed is protected the GPL's grandfather clause.
Well, that may not be a huge victory (Did anybody expect Microsoft to suddenly give up on its patents or start GPL'ing its code because of GPLv3 and the Novell deal ?), but it's something. It'll be interesting to watch the GPLv3 / Novell deal interpretation match in the next few weeks.
*They're involved in the distribution*
Posted Jul 8, 2007 0:47 UTC (Sun) by subscriber rickmoen
Ciaran O'Riordan wrote:
> According to the GPLv3 lawyers, they're "procuring the distribution of" > GPL'd software, and that requires permission from the copyright holder. > So Microsoft are either distributing under the permissions which the GPL > grants them, or they are violating copyright.
Quite. Moreover, this does affect preexisting software covered by the Novell-Microsoft patent-shakedown agreement, too (not just future releases under GPLv3), because a great deal of existing software in both Novell SLES10/SLED10, per upstream licensors' terms, can be received by users under GPLv2 or, at their option, _any later version_.
For that matter, Microsoft Services for Unix (nee Interix) is affected in exactly the same fashion, because it, too, includes a great deal of upstream, third-party code that users may accept under GPLv2 or any later version.
[ ... ]
[ Thread continues here (1 message/4.27kB) ]
SugarCRM goes to GPLv3
Rick Moen [rick at linuxmafia.com]
Wed, 25 Jul 2007 21:22:04 -0700
LWN has a new story (currently subscriber-only) about SugarCRM announcing that its upcoming 5.0 release of SugarCRM Community Edition will be under GPLv3 (as opposed to the company's current badgeware licence, this having been the firm that invented the concept).
Press release: http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=104&STORY=/www/story/07-25-2007/0004632607&EDATE=LWN item (brief mention only; no analysis): http://lwn.net/Articles/242968/
I've just posted this comment to LWN:
*Is this a blunder, or just too subtle for me?*
Posted Jul 26, 2007 4:18 UTC (Thu) by subscriber rickmoen
I may be missing something, here, so I'm phrasing this in the form of a question or two, and it's not rhetorical: Didn't FSF bow to pressure from sundry interest groups and remove the "ASP loophole" language[1] that had been present in some GPLv3 drafts? Therefore, what in Sam Hill is a Software as a Service (Saas) / ASP / Web 2.0 firm doing adopting a copyleft language whose copyleft language gets finessed by hosted deployment?
FYI, there are a number of genuinely open source licences, a couple of them OSI certified, that do apply copyleft obligations to the ASP industry. One of the best is Larry Rosen's OSL, and there is also Apple's ASPL, both of those being OSI-certified. Non-certified options include Affero GPL (newly reissued as a patch to GPLv3, by the way) and Honest Public License.
On the basis of recent history, it's possible that SugarCRM not only lacks any clever, non-obvious reason why it picked a non-ASP copyleft licence for ASP code, but also doesn't really have any idea what it's doing in this area, and picked GPLv3 just because it has had good press (good press that it generally deserved, IMVAO). Remember, this is the firm that created the first MPL-based ASP licence, and then acted shocked and indignant when it belatedly discovered that its licence permitted forking (when TigerCRM of Chennai forked the codebase), and overreacted by writing what became the prototype MPL + Exhibit B "badgeware" licence that impairs third-party usage through mandated logo advertising without a trademark licence.
It'd be more reassuring if I thought this firm had a master plan, but I now rather strongly suspect it's just a bunch of sales people in an office in Cupertino, staggering from one inadvertant move to the next.
Rick Moen [email protected]
[1] http://weblog.infoworld.com/openresource/archives/2007/03/gplv3_goes_weak.html
[ Thread continues here (2 messages/3.61kB) ]
[lg-announce] Linux Gazette #140 is out!
Rick Moen [rick at linuxmafia.com]
Mon, 2 Jul 2007 09:32:25 -0700
[[[ I have included a portion of this thread for general interest, but the rest of the housekeeping has been elided. -- Kat ]]]
Quoting Ben Okopnik ([email protected]):
> July 2007 (#140): > > * Mailbag > * Talkback > * NewsBytes, by Howard Dyckoff
There was something I annotated at the time of my svn checkin of lg_bytes -- but just realised I should have ALSO put into the STATUS notes. (I'll bet in retrospect that nobody pays attention to svn checkin comments.)
Howard had:
Red Hat Adds Business Solutions to Open Source RHX RHX launch partners include Alfresco, CentricCRM, Compiere, EnterpriseDB, Groundwork, Jaspersoft, Jive, MySQL, Pentaho, Scalix, SugarCRM, Zenoss, Zimbra, and Zmanda.Problem: A bunch of those are JUST NOT OPEN SOURCE. Zimbra, SugarCRM, Compiere, Groundwork, and Scalix are classic "badgeware", which is under MPL-variant software with some restrictions -- while with CentricCRM, there's not even any room for controversy, since their licence doesn't even permit code redistribution. Jive Software (which I'd not heard of, before) turns out to be equally bad.
I have brought this matter, several times, to Red Hat's attention, and the presence of actively misleading wording on the Red Hat Exchange site, such as this at the top of http://rhx.redhat.com/rhx/support/article/DOC-1285:
Red Hat Exchange helps you compare, buy, and manage open source business applications. All in one place and backed by the open source leader. We've collaborated with our open source software partners to validate that RHX applications run on Red Hat Enterprise Linux and are delivered through the Red Hat Network. At RHX, Red Hat provides customers with a single point of contact for support.There has been no response and no correction of this error, but the very bottom of that page now has this "FAQ" item:
Are you only accepting open source ISVs into RHX? The initial set of participating ISVs all have an open source focus. We realize that there is debate about which companies are truly open source. To make it transparent to users, RHX includes information about each ISV's license approach. Longer term, we may introduce proprietary applications that are friendly with open source applications.That is, of course, anything but a straight answer. First, it's nonsense to speak of companies being open source or not -- and the above paragraph in general ducks the question. The issue is whether software is. Second, even if there were debate about the badgeware offerings allegedly being open source, there could be absolutely none about Jive Software's Clearspace or CentricCRM 4.1, which are unambiguously proprietary.
I'm surprised that this Red Hat's deceptive characterisation got past Howard without comment, given that the matter's been extensively covered in recent _Linux Gazette_ issues.
[ ... ]
[ Thread continues here (2 messages/5.40kB) ]
when is an open source license open source?
Rick Moen [rick at linuxmafia.com]
Wed, 27 Jun 2007 14:51:36 -0700
----- Forwarded message from Rick Moen <[email protected]> -----
Date: Wed, 27 Jun 2007 14:45:53 -0700 From: Rick Moen <[email protected]> To: Ashlee Vance <[email protected]> Cc: Karsten Self <[email protected]> Subject: Re: (forw) Re: when is an open source license open source?Quoting Ashlee Vance ([email protected]):
> Rick, your explanation helped a great. Who are the main culprits of > consequence besides Sugar?
SugarCRM started the trend, and the other dozen-odd firms (Socialtext, Alfresco, Zimbra, Qlusters, Jitterbit, Scalix, MuleSource, Dimdim, Agnitas AG, Openbravo, Emu Software, Terracotta, Cognizo Technologies, ValueCard, KnowledgeTree, OpenCountry, 1BizCom, MedSphere, vTiger) literally copied their so-called "MPL-style" licence, with minor variations. MuleSource was for a long time a vocal backer of SugarCRM's position (but see below).
Alfresco used to be a major backer of that position, but then suddenly decided to shift to GPLv2, which is what they use now. (They are no longer a badgeware firm.) Company spokesman (and OSI Board member, and attorney) Matt Asay says he tried all along to convince them to do that, and I do believe him.
SocialText (and especially CEO Ross Mayfield) has taken a lead online role in trying to resolve the impasse -- though I personally find most of what he says to be almost purely rationalising, and for him to be mostly unresponsive to (or evasive of) substantive criticism.
MuleSource and Medsphere have, within the last few months, improved their respective MPL + Exhibit B licences (http://www.mulesource.com/MSPL/ http://medsphere.org/license/MSPL.html) very dramatically, in direct response to criticism on OSI's license-discuss mailing list. This work seems to be that of attorney Mitch Radcliffe, and encouraged by MuleSource and Medsphere Board member Larry Augustin (formerly of VA Linux Systems). I have great respect for this work, though I am still trying to properly assess and analyse it.
(Disclaimer: Larry is a friend of mine, though I see him only rarely, and I once was employed at one of his firms.)
You should be made aware of the role of vTiger (of Chennai) in all of this: In August 2004, it forked and since then has offered independently, under its own name and brand, an early version of the SugarCRM codebase, plus various changes of their own devising. It was in response to that forking event, to which SugarCRM CEO John Roberts responded very angrily at the time, that SugarCRM adopted the "Exhibit B" restrictive licensing addendum that then became the hallmark of badgeware licences generally. See second post on http://www.vtiger.com/forums/viewtopic.php?p=22 , and the matching apologia at http://www.vtiger.com/forums/viewtopic.php?p=22 by Christiaan Erasmus of badgeware firm ValueCard (South Africa).
----- End forwarded message -----
[ Thread continues here (5 messages/13.37kB) ]
Red Hat flags OSI offenders on partner site - Register Article
Martin J Hooper [martinjh at blueyonder.co.uk]
Wed, 25 Jul 2007 07:40:32 +0100
http://www.theregister.co.uk/2007/07/25/rhx_change_redhat/
Rick you might be interested in this article as you had been commenting on the topic recently...
[ Thread continues here (2 messages/1.60kB) ]
[Tech briefing invite: 'What can be called open source?']
Rick Moen [rick at linuxmafia.com]
Thu, 28 Jun 2007 08:59:08 -0700
[Forwarding Ben's private mail, with commentary, at his invitation.]
As a reminder, Centric CRM, Inc. has recently been one of the most problematic of the ASP/Web firms abusing the term "open source" for their products, in part because their flagship product (Centric CRM) has been notorious during most of this past year as the most clearly and unambiguously proprietary software to be offered with the ongoing public claim of being "open source".
I'd call this (below-cited) PR campaign blitz -- apparently, they're intensively hitting reporters known to be following this matter -- really good news, though it has to be read attentively:
o Former OSI General Counsel Larry Rosen's "OSL 3.0" licence is a really good, excellently designed, genuine copyleft licence that is especially well suited for ASP use, because it's one of the very few that have a clause enforcing copyleft concepts within the otherwise problematic ASP market. (In ASP deployments, there is ordinarily no distribution of the code, so the copyleft provisions of most copyleft licences such as GPLv2 have no traction, and are toothless.) Also, as Centric CRM, Inc. is keen to point out, OSL 3.0 is an OSI-certified open source licence. o At the same time, the careful observer will note that this announcement concerns the product "Centric Team Elements v. 0.9", which is not (yet?) the firm's flagship product. That flagship product remains the entirely separate -- and very, very clearly proprietary, product "Centric CRM v. 4.1", which one wryly notices has been carefully omitted completely from this communique. Just in case there is any doubt about Centric CRM 4.1's proprietary status, here's one key quotation from the product brochure, about the applicable licence, "Centric Public Licence (CRM)": "The major restriction is that users may not redistribute the the Centric CRM source code."Now, it may be that the Centric CRM product is on the way out, and that Centric Team Elements (with genuine open source licence) will be taking its place. Or maybe not. Either way:
The bad news, but perhaps not too bad, is that Centric CRM, Inc. has spent this past year to date falsely and misleadingly claiming that its product line is open source -- and deflecting critics by claiming that the term "open source" is (paraphrasing) subject to redefinition and needn't be limited to what OSI (inventer of that term in the software context, and standard body) defines it to be. That misleading and deceptive language is still very much a prominent part of the company's pronouncements to this day, remains on the Web site, and doesn't seem to be disappearing.
The good news is that the firm appears to be sensitive to the public relations problem it created for itself, and may be taking steps to fix it.
----- Forwarded message from Ben Okopnik <[email protected]> -----
[ ... ]
[ Thread continues here (1 message/16.71kB) ]
I kill me. I just do.
Rick Moen [rick at linuxmafia.com]
Thu, 26 Jul 2007 14:38:28 -0700
My reply, just posted, is reproduced below the forwarded posting from "khim".
----- Forwarded message from LWN notifications <[email protected]> -----
Date: 26 Jul 2007 16:01:24 -0000 To: [email protected] From: LWN notifications <[email protected]> Subject: LWN Comment response notification
The following comment (http://lwn.net/Articles/243195/) has been posted in response to http://lwn.net/Articles/243075/.
As you requested, the text of the response is being sent to you.
*Is this a blunder, or just too subtle for me?* [Announcements] Posted Jul 26, 2007 16:00 UTC (Thu) by khim FYI, there are a number of genuinely open source licences, a couple of them OSI certified, that do apply copyleft obligations to the ASP industry. Yup. And they are mostly unsuccessful ones. It's quite hard to distinguish two cases:To stop receiving these notifications, please go to http://lwn.net/MyAccount/rickmoen/. Thank you for supporting LWN.net.1) where your package is used for SaaS (like Google) 2) where your package is used for some private endeavour (like LWN)Licenses like AGPL/APSL punish equally - that's why I'll probably never use AGPL/APSL-licensed software. And if I'll be forced to use such software I'll do everything possible to not ever fix or change it. Even badgeware is better from practical viewpoint. If you'll think about it it's only logical. Yes, usurpation of the code by SaaS vendors is a problem but AGPL is worse medicine then disease itself...
----- End forwarded message -----
*Is this a blunder, or just too subtle for me?*
Posted Jul 26, 2007 21:38 UTC (Thu) by subscriber rickmoen
"khim" wrote:
> Yup. And they are mostly unsuccessful ones.
Your "unsuccessful". My "underappreciated so far".
> It's quite hard to distinguish two cases:
And, in my personal view, pointless. (My opinion, yours for a small fee and agreement to post my logo on your forehead. And by the way, I also deny the premise that LWN is a "private endeavour" in any sense meaningful to this context. Of course, Jon and co. happen to use their own code, IIRC.)
Rick Moen [email protected]
For Approval: Open Source Hardware License
Rick Moen [rick at linuxmafia.com]
Fri, 6 Jul 2007 12:16:43 -0700
Ever have one of those days, where you fear that your sarcasm might have become so caustic that it might need hazardous-substance labels?
----- Forwarded message from Simon Phipps <[email protected]> -----
Date: Fri, 06 Jul 2007 18:21:01 +0100 From: Simon Phipps <[email protected]> To: Rick Moen <[email protected]> Cc: [email protected]X-Mailer: Apple Mail (2.752.3)
Subject: Re: For Approval: Open Source Hardware License
On Jul 6, 2007, at 02:12, Rick Moen wrote:
>Quoting Jamey Hicks ([email protected]): > >>There are no OSI-approved licenses for open source hardware, so I am >>proposing this license. > >My understanding is that OSI's licence approval process >(http://www.opensource.org/docs/certification_mark.html) is specifically >for software licences. That scope limitation came up previously when >people proposed documentation licences for certification; I suspect the >same logic applies here.
I'm afraid the distinction between "software" and "hardware" is getting harder and harder to make. The Verilog that's used to make the UltraSPARC T1 is definitely software, and the GPL (or any other Free software license approved for open source community use by OSI) seems 100% applicable to me.
If we allow special "hardware" licenses because the copyrighted work is used for that purpose, we are on a slippery slope towards many other specialist (an in my view redundant) sub-categories.
S.
----- End forwarded message -----
----- Forwarded message from Rick Moen <[email protected]> -----
Date: Fri, 6 Jul 2007 11:43:36 -0700 From: Rick Moen <[email protected]> To: [email protected] Subject: Re: For Approval: Open Source Hardware LicenseQuoting Simon Phipps ([email protected]):
> I'm afraid the distinction between "software" and "hardware" is > getting harder and harder to make.
You know, there are circumstances in which I'd raise that point, too. However, I'd feel a bit silly raising it in circumstances where something is described very unambiguously aas a licence specifically for hardware _and used_ (or at least planned to be used) only for that purpose, to a groups that certifies licences specifically for software.
(I do doubt that OSI would refuse to certify a licence actually used for software, on no better grounds than it having the word "hardware" in it.)
Nonetheless, your ability to discern shades of grey is admirable. ;->
-- Cheers, English is essentially a text parser's way of getting Rick Moen faster processors built. [email protected] -- John M. Ford, http://ccil.org/~cowan/essential.html
RHX and License Clarity
Rick Moen [rick at linuxmafia.com]
Thu, 5 Jul 2007 11:03:57 -0700
Trying to figure out how little they can do?
----- Forwarded message from Matt Mattox <[email protected]> -----
Date: Thu, 05 Jul 2007 13:20:56 -0400 From: Matt Mattox <[email protected]> To: [email protected] Subject: RHX and License ClarityHi Rick,
Just a quick note responding to your comment in the "More About RHX" section of RHX. We're working on a solution that will make the license approach used by each RHX software vendor very clear to users, including whether or not they are OSI-approved. I'd love to get your feedback on our approach if you have the time and interest. Let me know....
Thanks, Matt Product Manager, RHX
----- End forwarded message -----
----- Forwarded message from Rick Moen <[email protected]> -----
Date: Thu, 5 Jul 2007 11:02:52 -0700 From: Rick Moen <[email protected]> To: Matt Mattox <[email protected]> Subject: Re: RHX and License ClarityQuoting Matt Mattox ([email protected]):
> Just a quick note responding to your comment in the "More About RHX" > section of RHX. We're working on a solution that will make the license > approach used by each RHX software vendor very clear to users, including > whether or not they are OSI-approved. I'd love to get your feedback on > our approach if you have the time and interest. Let me know....
Hi, Matt. Thank you for your note.
The main problem is actually the statements on the RHX main Web pages that serve as entry points to RHX (and, in the recent past, by all RHX press releases). For example:
Starts out with "Trusted open source software" -- without saying that some offerings are open source and some proprietary -- and goes on for the entire page talking how RHX has helped you select open source applications, etc.http://rhx.redhat.com/rhx/support/article/DOC-1285 ("More about RHX" page)
Starts out with "Red Hat Exchange helps you compare, buy, and manage open source business applications. All in one place and backed by the open source leader. We've collaborated with our open source software partners to validate that RHX applications run on Red Hat Enterprise Linux and are delivered through the Red Hat Network."Letting people _dig down_ to licensing specifics would be nice but wouldn't fix the problem of false and misleading general statements everyone encounters on the way in. The latter should be replaced without delay.
And future RHX press releases should mention that it includes both proprietary and open source applications.
The longer the delay in fixing this problem, the more Red Hat's reputation for integrity is suffering. Please make no mistake: Your firm is being damaged by this.
----- End forwarded message -----
[ Thread continues here (3 messages/5.47kB) ]
Red Hat Exchange has a serious flaw
Rick Moen [rick at linuxmafia.com]
Wed, 27 Jun 2007 11:56:06 -0700
----- Forwarded message from rick -----
Date: Tue, 26 Jun 2007 21:21:42 -0700 To: [email protected] Cc: Karsten Self <karsten> Subject: Red Hat Exchange has a serious flawDear Ashlee:
I note with interest your recent articles in ElReg: "Red Hat's Exchange roars like a muted lamb" and "Red Hat RHXes out to open source partners". However, I'd like to point out one problem you haven't yet covered:
Many of Red Hat Exchange's offerings, although all are implied to be open source, are in fact nothing of the kind. For example, the offered products from Zimbra, SugarCRM, Compiere, CentricCRM, and GroundWork are very clearly under proprietary licences of various descriptions.
When I attended Red Hat's RHEL5 product launch in San Francisco on March 14, I heard RHX described for the first time, immediately noticed the problem, and quietly called it to the attention of Red Hat CTO Brian Stevens. Stevens acknowledged the point, and said (loosely paraphrased) that their Web pages should to be adjusted to make clear that not all RTX offerings are open source -- which is indeed a sensible remedy, but it hasn't yet happened.
I also attempted to call Red Hat's attention to the problem via the designated RHX feedback forum, at http://rhx.redhat.com/rhx/feedback/feedback.jspa . (You'll note my comment near the bottom.)
I'm sure it's an honest slip-up, but, accidentally or not, Red Hat has mislead its customers for the past several months on this matter, and is continuing to do so.
Best Regards, Rick Moen [email protected]
----- End forwarded message -----
----- Forwarded message from Rick Moen <[email protected]> -----
Date: Wed, 27 Jun 2007 11:54:04 -0700 From: Rick Moen <[email protected]> To: Ashlee Vance <[email protected]> Cc: Karsten Self <karsten> Subject: Re: Red Hat Exchange has a serious flawQuoting Ashlee Vance ([email protected]):
> Thanks so much for this, mate. Will investigate.
Sure. In case it will help:
Most if not all of those codebases are ASP (Web app) code, which poses a thorny problem: Suppose you are, say, Google, and wish to behave benignly towards open source with your Web apps. You deploy a Web 2.0 hosted application, and release its source code to the community under a proper, forkable licence such as BSD / MIT X11 (simple permissive type) or GPLv2 (copyleft), that fully satisfies the Open Source Definition. For the sake of illustration, let's assume GPLv2.
Google's competitor EvilCo swoops by, grabs the source tarball, modifies it extensively behind closed doors, and deploys it under a completely different name as a hosted Web app (product/service) of its own, bearing very little resemblance to Google's original application. Let's say that EvilCo nowhere mentions its borrowing from Google, and that EvilCo doesn't provide anyone outside its employees access to the modified source code.
[ ... ]
[ Thread continues here (1 message/6.71kB) ]
RHX: Red Hat, Inc. does the right thing
Rick Moen [rick at linuxmafia.com]
Fri, 13 Jul 2007 11:48:26 -0700
Red Hat, Inc. seems to have taken quick and effective action to correct some misleading statements about licensing that had previously been on the firm's Web pages for the "Red Hat Exchange" (RHX) partner-software sales program:
http://www.redhat.com/rhx/ https://rhx.redhat.com (and sub-pages)
Their corrections have been quite thorough and accurate! The firm should be commended for this very responsive action. E.g., the main description pages for RHX say things like:
RHX helps you compare, buy, and manage business applications -- all available from the open source leader. All in one place. We've done the work for you. You'll find profiles, ratings, priceseven free trials -- for every application. Working in collaboration with our partners, applications are validated to run on Red Hat Enterprise Linux, delivered through Red Hat Network, and backed by Red Hat as the single point of contact for support.All of the former claims and implications of RHX's offerings being uniformly open source have been corrected, top to bottom. I've sent a specific thanks to the manager in question.
-- Cheers, "Learning Java has been a slow and tortuous process for me. Every Rick Moen few minutes, I start screaming 'No, you fools!' and have to go [email protected] read something from _Structure and Interpretation of Computer Programs_ to de-stress." -- The Cube, www.forum3000.org
