First Draft of GPL Version 3 Released

njan writes "The first draft of version three of the GNU General Public License was released to the public this afternoon. Major improvements touted in version three include changes designed to mitigate the damage posed by new threats to free software such as software patents. One individual stated about the release: 'It is changes in law, not computer technology, that pose the principal challenges to the free software community. Chief among these changes has been the unwise and ill-considered application of patent law to software. Software patents threaten every free software project, just as they threaten proprietary software and custom software. Any program can be destroyed or crippled by a software patent belonging to someone who has no other connection to the program.'"

Comments

From this...

[IAAP]

From the last paragraph section 1: As a special exception, the Complete Corresponding Source Code need not include a particular subunit if (a) the identical subunit is normally included as an adjunct in the distribution of either a major essential component (kernel, window system, and so on) of the operating system on which the executable runs or a compiler used to produce the executable or an object code interpreter used to run it, and (b) the subunit (aside from possible incidental extensions) serves only to enable use of the work with that system component or compiler or interpreter, or to implement a widely used or standard interface, the implementation of which requires no patent license not already generally available for software under this License.

I'm reading this as (bold area): if I compile my code with GCC and link with a GNU library, my code will not fall under the GNU license unlese I sat it does.

Re:How much of this...

[Renegade Lisp]

I like the anti-DRM idea very much. From the draft:

No covered work constitutes part of an effective technological protection measure: that is to say, distribution of a covered work as part of a system to generate or access certain data constitutes general permission at least for development, distribution and use, under this License, of other software capable of accessing the same data.

To me, that sounds like a breathtakingly simple way to undermine the whole purpose of the DMCA and DRM, simply by saying: Software under this license can never be a protection device that people are not allowed to circumvent. Almost as simple and elegant as the idea of copyleft itself. I'm very impressed.

great; now GPL software is prohibited on Windows!

[Anonymous Coward]

"The "Complete Corresponding Source Code" for a work in object code form ... includes ... any shared libraries and dynamically linked subprograms that the work is designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work"

So unless you can distribute the source code to Microsoft's DLLs you can't distribute binaries for GPL v3-licensed software running on Windows. Yeah, you can still distribute just the GPL v3-licensed source but realistically if users have to compile an app themselves the number of users will drop off dramatically.

Dumb, dumb, dumb.

Re:Other issues

[Anonymous Coward]

When it comes to patents, the draft is actually not very aggressive about them. There is no general patent retaliation clause as in some other licenses, because the FSF believes that disallowing an offender to use any free software would not be too much of a deterrent for some.

I'm glad they stepped off this one. The stuff I was reading at one time seemed quite a bit draconian about it and, to put it mildly, quite hypocritical when they say "free/open/libre" software but then "you can't use it".

Web services?

[Just Some Guy]

There's been much debate for and against allowing people to "publish" modified GPLed web applications without releasing the source. For example, phpBB is released under the GPL, and some believe that you should be required to make any changes to it available to your site visitors.

I didn't see any wording in the draft that addresses this issue either way; every time I thought I did, I found the same or similar wording in version 2. So, is it in there? Will it affect how we publish web applications?

Re:Web services?

[Just Some Guy]

So if a web application has such functionality, it can be released under a license that requires that functionality be kept, and that license would still be compatible with the GPL.

Crud. I think you're right. The FSF seems to have this fascination with "invariant sections", even though the rest of the planet thinks they are fundamentally non-Free.

If this draft is accepted, it looks like I'll be using GPLv2 (and v2 only) from now on. This whole thing reeks of second-system effect and I'd rather not have anything to do with it.

Re:Web services?

[jamienk]

Usually the GPL doesn't allow you to mix in code that is MORE restrictive than the GPL. You can mix in code that is LESS restrictive (e.g., code in the public domain, or code under a BSD license). BUT this draft of the GPL version 3 says that there are a few exceptions where you CAN mix in code that has certain enumerated restrictions beyond the GPL. One of these ALLOWED RESTRICTIONS is if a license requires that code has a way for users of that code to "immediately obtain copies of its Complete Corresponding Source Code" (section 7d).

I imagine that this could apply to web services -- I could release my big PHP app under the GPL license with the added restriction that "if you want to distribute or modify my web app, you have to have some sort of link to the source code, or else you can't modify the part of the program that provides that link." This is allowed now, I can have any reasonable terms in my license that I want (my license is the only thing that lets you distribute or modify my code), but under versions of the GPL prior to 3, my code wouldn't be COMPATABLE with GPL code; you couldn't COMBINE my code with your GPL code.

If you do release your code under v3 of the GPL, then people can mix your code with my "GPL plus link to source"-licensed code. If you release your code under version 2 only, my code can't be mixed with yours.

I think this is a good solution to the "problem" of web services. Remember, the problem was that people can take my GPL'ed code, change it, and run it over the Internet and not release their changes back to the community. In some ways this goes against the spirit that the codes' authors may have felt -- they wanted changes to be "fed back" into the community. On the other hand it could be argued that, by adding a new restriction to my code that goes beyond the GPL's core "share back" -- I'm now in effect saying "this program MUST have this functionality" -- I'm limiting a freedom that the GPL wants to protect -- the freedom to modify the code.

I think section 7d is a brilliant compromise: allow such code to be mixed with GPL'ed code. This keeps the GPL pure, but opens the door to code that isn't philosophically objectionable.

Re:Other issues

[jmv]

I think I understand what they're trying to do with this. Without the clause, I could (theoretically) take a GPL program, add "pseudo-DRM" to it and then sue whoever removes that DRM from the (GPL) code using the DMCA. With the clause, I'm "forced" (if I want to distribute the program) to state that my stuff isn't an "effective technological protection measure" (which I assume is the phrasing of the DMCA). Would be much harder to defend in a court "Yes, I know we say in the license that it's not an effective technological protection measure, but we for the purpose of this lawsuit, we would like to change our mind...". Anyway, I'm not sure how strong a protection it offers, but I can't see that really hurting anyone.

Re:Other issues

[AuMatar]

Not quite. What they want to do is make it legal to try and decypt content GPLed code protects. By stating they are not an effective protection method, they are not covered by the DMCA. Therefor, you can try and remove the encryption from any content that the program produced (possibly any content it can read?). As for legality, I'd think its fairly strong- whoever releases it under the GPL license is voluntarily agreeing to this, and thus waiving the rights to sue under the DMCA (remember, breaking the DMCA is not a criminal act, but a civil tort).

Re:How much of this...

[JanneM]

To me, that sounds like a breathtakingly simple way to undermine the whole purpose of the DMCA and DRM, simply by saying: Software under this license can never be a protection device that people are not allowed to circumvent. Almost as simple and elegant as the idea of copyleft itself. I'm very impressed.

I'm not. That would mean that any cryptographic software could never be GPL licensed. You won't have a Free implementation of the protocol used for you to connect securely to your bank, since it is illegal in many places to intercept and decrypt such privileged communications.

Relicense?

[Julian Morrison]

One question for OSS projects currently using GPL, will be, should they relicense?

For example, should Linux become GPL3'd?

Discuss...

Re:Other issues

[Anonymous Coward]

I'd be curious to see what an objective lawyer has to say about the enforceability of that clause. Being an "effective technological protection measure" seems like a matter that can't be waived, any more than my signing a stipulation that I wasn't born in August affects my birthday.

This objective lawyer agrees with your initial impression. I searched to the section of the draft that expressed this issue, confident that because there were attorneys working on the draft, it couldn't possibly express this concept in the language that others have used in the comments. I was wrong:

No covered work constitutes part of an effective technological protection
measure: that is to say, distribution of a covered work as part of a system
to generate or access certain data constitutes general permission at least
for development, distribution and use, under this License, of other
software capable of accessing the same data.

Statutory definitions cannot be changed by contract. Period. If you and I sign a contract that defines our upcoming battle royale on the street in front of my house as a "sporting event", we can still assuredly be arrested for assault and battery upon each other (at the very least). This language expresses an objective that is analogous to that hypothetical.

Imagine this:

1. Programmer A writes software that would be an effective technological measure but for this clause.
2. Programmer A distributes said software in combination with Copyright Owner B's work under license (as if this wasn't uncommon) as Work Z. For the argument's sake, let's assume that the copyrighted work is stored in separate data files that are distributed with the object code, but not the source code.
3. Programmer C uses said software to access Work Z without 'permission'.

The license extends between Programmer A and Programmer C. The license does nothing to bind Copyright Owner B. Yet the language from sec 1201 of the DMCA (the anticircumvention provisions) states that the person that must give permission is the copyright owner.

''(3) As used in this subsection--
''(A) to 'circumvent a technological measure' means to
descramble a scrambled work, to decrypt an encrypted work, or
otherwise to avoid, bypass, remove, deactivate, or impair a technological
measure, without the authority of the copyright owner;
and
''(B) a technological measure 'effectively controls access to a
work' if the measure, in the ordinary course of its operation, requires
the application of information, or a process or a treatment,
with the authority of the copyright owner, to gain access
to the work.

This means that if I represent Copyright Owner B, I can sue Programmer B and any other unauthorized person who accesses Work Z using Programmer A's source, or a derivative work created from that source, even if Programmer A cannot. If you believe that Programmer A's implied-by-license permission is sufficient to protect a third party from a lawsuit, think again. The third party is the one violating the copyright by accessing the work without authorization, and by presumably making at least a transient copy of the copyrighted work. Any lawyer will tell you that Programmer A cannot sell/distribute/convey rights greater than the rights that have been granted to him/her, just like Programmer A cannot sell Copyright Owner B's house to Programmer C.

Oops.

read Karl Popper

[criscooil]

This reminds me of something similar which has been explored in depth by Karl Popper, namely the problem of how does a free society protect itself from people who would use that freedom to change the society so that its no longer free. For example how does a democracy prevent a party from getting elected which would end the democracy? I cant give you a 25c summary, because it is a complicated subject, and I cant remember all of it anyway (its been years). However, if you're interested, I highly recommend reading Popper. His stuff is easy to read, and he deserves to be more widely known.

Re:No more GPG encryption

[miyako]

This just kind of popped into my head- but I wonder. If GPG is not considered an "effective protection devise" or whatever the legalease is- could a company who was using GPG to protect customer information or some such be sued for failing to provide "adequate" protection of customer information.

The R in DRM?

[bzipitidoo]

GPLv3 is calling DRM Digital Restrictions Management. A good description, but isn't the term actually Digital Rights Management? Ought to state both terms. Would hate to lose a court case on a technicality based on imprecise terminology. I thought renaming it Restrictions was a clever joke, and we don't want the GPL to look like a joke. Gives opponents a wedge they can use to try to discredit the whole thing.

Re:No more GPG encryption

[mce]

The problem with that is that the app "not being an effective DRM app" is specifically tuned to target the US DMCA, wheras the GPL has to survive internationally. Other countries, other definitions, so: 1) Who says that "not being an effective DRM app" is any good at defeating the local DMCA equivalent of country X? and 2) Who says that it isn't in conflict with national law regarding what consititutes DRM in country Y?

Re:How much of this...

[JanneM]

In other words, you could write ssh under GPL v3, but it would be legal to crack it. Not necessarily possible, just legal.

Nope. In most countries at least, law trumps contract. What would happen is that the license is invalidated, and the software in no longer free.

As a commercial developer, I'm always unsure....

[CFD339]

...about downloading and trying any GPL library because ultimately I've found too many unclear explanations on what I can and cannot do with it related to code I make money on. In some cases, I'd like to pay for the right to use it commercially but can't even figure out who to write the check to and for how much.

I wish authors releasing good libraries under GPL would also assume that is OK to make money with it too. Just spell out the terms and conditions for us commercial types too. Not all of what I do is commercial of course, some is free (as in beer) in which case GPL tends to be fine.

I hate being the kind of person who uses other people's contributions but can't contribute back all the time. I hope the new license clears some of this up for me.

Re:No more GPG encryption

[AuMatar]

DMCA is a civil tort, not a criminal law. By using the GPL, they would voluntarily give up their right to sue by declaring they aren't a protection device. Its not a matter of trumping in this case.

It's a EULA

[cyberformer]

The Affero license has been "testing" the Web Services clause for a while.

The problem for Free Software purists is that it's a EULA: It restricts use, not just copying. That seems to contradict the "not a contract" part of the GPL, and probably can't be enforced in many jurisidctions (although it is a way of fighting back against UCITA or similar laws / court decisions that make EULAs binding).

Re:Other issues

[cpt kangarooski]

I'm afraid you're incorrect.

As an example, here is 17 USC 1201(a)(2):

(2) No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that--
(A) is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a work protected under this title;
(B) has only limited commercially significant purpose or use other than to circumvent a technological measure that effectively controls access to a work protected under this title; or
(C) is marketed by that person or another acting in concert with that person with that person's knowledge for use in circumventing a technological measure that effectively controls access to a work protected under this title.

Since the the statute uses the word 'or,' a product that satisfies any one criterion is unlawful to traffic in; satisfaction of all three criteria is not required.

The main problem is (a)(2)(B). Just because there are lawful uses to which a circumvention product may be put (such as in conjunction with a GPL'ed work or public domain works) that still tends to leave it with a limited commercially significant use. The Reimerdes court considered whether DeCSS could be lawful to traffic in, given that it could be used not only unlawfully to circumvent DRM for copyrighted movies, but also lawfully to circumvent DRM for public domain movies. Nevertheless, this was not a significant enough use, and DeCSS was not saved.

Therefore, Alice can sue Carol successfully, because there are a lot of Alices, and few Bobs.

Friendly explanations are far more becoming.

[jbn-o]

Lots of lawyers are wrong in their legal views and some of them even lose cases. Lots of basketball players who can perform slam dunks sometimes miss the basket and sometimes lose games. Being an expert doesn't mean you're above being questioned. But you apparently don't even like for people to question whether you're really a lawyer, so you post anonymously, giving us no information to determine if you're actually a lawyer as you claim to be.

Eben Moglen, counsel for the FSF, is also a lawyer who has said repeatedly that "Licenses are not contracts". Perhaps you would take the matter up with him instead. After reading his essays and listening to his talks, I find him to be a far more patient and informative speaker than you appear to be. Then again, he might object to some anonymous nobody claiming to be a lawyer arguing a point with him that he's rehashed so many times.

Pamela Jones, a journalist with a paralegal background who runs Groklaw, has gone on record saying that "The GPL is a license, not a contract" in which she cites Moglen's essay and expands on it a bit. Perhaps you'd rather discuss the matter with her, since she too might be more on your level of expertise.

But I think it's telling that instead of patiently explaining the difference between the terms 'license' and 'contract' you instead chose to take a needlessly confrontational and remarkably uninformative route to point out that most non-lawyers don't understand the terms. It's unfortunate that the /. moderators don't seem to penalize such posts in an attempt to raise the level of discourse here.