Slashdot Mirror
FOSS License Proliferation Adding Complexity
E5Rebel writes "Business is embracing open source like never before, but the effective demise of SCO's claims against Linux doesn't mean an end to licensing problems, an analyst warns. The debate on Slashdot seems to focus on the GPL and its virtues, but there are 1,000-plus open source licenses (according to analyst Saugatuck), and businesses face having to manage multiple licenses within a single open source product. What can be done to minimize multiple-license pain for corporate open source adopters?"
Open source has a long ways to go to match the number of different closed source licenses and eulas. Amateurs....
Why does the large number of licenses have to be a management problem? Most the proliferation in business is the usage, not the development of open source, and a bulk of the open source licenses say you can use it however you want, it's only when you distribute it (Modified or unmodified) that you have to start worrying about exactly what is in the license.
I'm pretty sure there are no 1000+ OSI approved licenses.
10 OSI approved licenses probably cover 90% of all open source.
Patents Drive Free Software as Hurricanes Drive Construction Industry
Easy.
Yeah, I knew you could. The average Linux distribution doesn't have anything close to a 1000 licenses in it. Stop being ridiculous. There is pretty much BSD/MIT/X11, GPL, LGPL, Mozilla, Artistic, and maybe a couple of others, depending on what apps are installed.
And in the end -- so what? FOSS licenses break down into two categories: BSD-type and GPL-type. That's it. They're all pretty much the same, especially ones that conform to the Open Source Definition, so who cares?
My blog
Ignore it.
At some point, it will become clear that enforcing all this licensing bullshit with courts and lawyers is just a big waste of time that drains everyone dry, and they'll drop the foundational laws upon which both open and closed source licensing agreements rely.
Then the problem will go away.
I mean, it's a problem of our own making... it's like hitting yourself in the head, all you have to do is stop.
-1 Uncomfortable Truth
Its no different for proprietary software, in which the number of licenses is basically equal to the number of pieces of software you have ordered.
They cover a broad range of licensing needs. If there are hundreds of different licenses out there, it's only because the lawyers working for the firms involved have sold these companies on the notion that they need a custom-crafted license.
Read the EFF's Fair Use FAQ
Oh, boo hoo! Free stuff is hard!
What is more difficult and expensive? Reading, understanding and adhering to any of a number of open-source licenses and keeping track of what you're using and what practices you need to follow to use them for free -- or investing a lot of R&D and development and Q&A time for your own proprietary stuff?
I understand there is potential for occasional confusion, but that is also simply the product of selfish archaic businesses. People who aren't so much confused by open-source licenses or hurt by them as they are interested in exploiting and infringing on them. Claiming that the reason they are either failing to embrace open source or excusing their willful infringement on it as the fault of the licenses and throwing their hands up like Barbie confronted with a math problem.
One out of control ball of momentum! Oh, wait, that's just Cmd Taco's poop leaking again. We love you Taco!
Check out Microsofts License-o-rama! If Microsoft as a corporation can't stick to even a few licenses what on earth makes anyone think that thousands of FLOSS programmers will share enough commonality among them that they would be willing to use fewer licenses.
Microsofts licensing site doesn't even address the individual EULA's for products. Each MS product has a license that is nearly always unique to that product. So I say let those that do the work decide on how they would like or not like to share it.
load "$",8,1
Why not take a note from actual software development and give licenses an inheritance hierarchy? I've always thought it was stupid that EULAs aren't standardized to a certain extent. If everyone knew a general EULA quite well, then companies could just state where their EULA differs from this common-knowledge EULA, instead of blindly clicking ok, consequences be damned. Same process could be applied to middleware licenses. One could even develope a license format whereby you could compile the various licenses among your project's components into one final license with most of its redundancy (hopefully) trimmed out. Of course, legalese was pretty much developed to obscure any such process and its strength is in its (evil) complexity. What a mess.
Heck, even copying from the hd to ram to run the code counts as copying (note that this copying is allowed by US law if the copy on the drive is legal, but not otherwise).
The vast majority of businesses will never trigger _any_ of the provisions of the licenses for their Open Source software because they will not publicly re-distribute the software in verbatim or modified form.
For those businesses that do, it is highly unlikely that they'll deal with more than the GPL or BSD licenses. Other licenses are important only for a single package or cluster of packages (e.g. the MPL, the Artistic License, or the Apache license), and companies that deal with these packages tend to be specialists in that area.
This just really isn't a practical problem for most businesses. It's an issue that software aggregators like distros or SourceForge need to deal with, but not your normal everyday business.
Evan Prodromou | evan@prodromou.name | http://evan.prodromou.name/
If you use open source software, and not redistribute it you can mostly ignore the open source license. You can use it on as many computers as you like with many strange license combinations. For closed commercial software you have to track all the licenses, for open source you do not have to track the number of uses.
The real question begins if you want to distribute a packet of open source software and want to know if they are license compatible. ANd the real trouble starts if you want to use a loophole of some license to sell it bundled it together with your own commercial software.
You are confused. I think you meant Apple "loyalists"
If you write software that you want to be paid for, release it under a for pay license.
If you write software that you don't want to be paid for, release it under a completely free license... maybe even anonymously.
If all software was released this way then there wouldn't need to be any odd licensing in a software package... everything is either free or for-pay.
Those who know, do not speak. Those who speak, do not know. ~Lao Tzu
How about commercial licences? At least with FOSS you have a few major ones. With commercial every one is unique and usually much more complicated.
bash-2.04$
bash-2.04$yes "Don't you hate dialup connections?"| write USERNAME
I personally will almost exclusively stick to the four major OS licenses: the GPL (any version), Apache, Mozilla, and (though purists may disagree) the BSD. My experience has been that a developer generally doesn't have to blend -- most of the web-related work I do is related to Apache, therefore that fits for the C++ development. Most of the web work is in one of the GPL'd languages (Perl, Python, PHP, or Ruby), etc.
Does this fit for most others? I don't know.
...Open Source isn't the only answer -- but it's almost always a better value than the alternatives...
Obviously they should stick with Shared Source.
It matters because then people have trouble hooking things together in a useful manner. You know, actually *using* that other code.
Which should make things interesting with the Microsoft licenses submitted to OSI which are all GPL-incompatible. Then, I'm sure we could just make new GPL-compatible versions in addition to those.
Also, I like how they get their name attached to a whole set of licenses. Perhaps Sun, IBM, Apple, etc. should have license sets named after them? Could be a great new source of revenue for OSI...
Don't most open source licenses have one thing in common: you can use the software and install it on as many computers as you want free of charge. The problem comes up when you modify the code and then want to redistribute it. My question is how many businesses are modifying tons of different programs so that they have to worry about tons of different licenses? And if your company is big enough that you are modifying tons of programs then don't you have legal department with an army of high priced lawyers who would love to do nothing else but make sure you dotted all your i's and crossed your t's when it comes to the licenses? Maybe I missed something.
Most proprietary ISPs tend to have their own End User License Agreements that is either specific to the company or the product. Adding to that 88% of the sourceforge projects choose one of 3 licenses. The GPL license prevails, at 77% of projects. The LGPL is second at 6%, and BSD trails in third at 5%. All other licenses account from 3% to 1%.n d-size-of-open-source.html
_ vista_eula_analysis/ (plenty of other article if you don't like this source)
http://asay.blogspot.com/2005/09/analyst-nature-a
So when dealing with open source projects you supposedly have a problem with license proliferation? You have to deal with 1000 licenses? I don't buy that.
Also it is worth to notice that it is common that EULAs have special clauses on how the software can be used, by who and how the software can be distributed within the organization. Some of these clauses can truly be quite interesting.
http://www.theregister.co.uk/2006/10/29/microsoft
All OSI approved open source licenses permit the distribution of software with little to no worry compared to EULA governed software. No more Bussiness Software Allicance audits which can threaten to disrupt your normal bussiness. It is when you change the software or distribute it externally that you have to worry about the open source software license, but then, that is a different discussion since it is not normal for proprietary software to allow that.
Dear Friend,
My late father was the finace minister for the pervious administration in Nigeria, in his weill he bequitehd me the income from meany open sourse licenses however since the new government crackdown we have had difficulites in tranparting themo out of th country. A reputable frind who can transport them out of the country for me needs a small advance to pay for expenses once we have these open sources license on the open market we can realize great proifit.
I have a limited introductory offer for any software you want at a low low rate per seat. Comes with Complemetary Viagra from te late presidents presonal stores.
Please send to my paypal account darl.mcbride@sco.com
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
This will ensure that license incompatibilities only last a limited time, commercial software can be sold/protected from leaks by teenagers and derivative works can be created both during and after the copyright duration.
New projects going forward should all be released public domain. Bam. *All* projects can now use your code. Because of crazy liability statutes and crazy precedence, you will need to put a disclaim of liability/warranty on the code when *you* distribute it, but there isn't any need at all to make others who distribute it do so by adding a license term contingent on *their* distribution--that's the biggest downfall of the non-advertising clause BSD license, but in practice isn't that big of a deal. I am not a lawyer, but I *don't* ANAL; sorry.
--
WHO ATE MY BREAKFAST PANTS?
Is there a single site that elaborates what the highlights of major licenses are? I get put off by reading these novels sometimes, not to mention the legalese sometimes gets me confused (yes I need to is smarter). Something like this would be great:
...
GPL: Can do this, this, and this. Can't do this, this and this.
GPL2: Can do this, this, and this. Can't do this, this and this.
Apache: Can do this, this, and this. Can't do this, this and this.
MS EULA: Can do this, this, and this. Can't do this, this and this.
Does anything like this exist today?
Would this reduce the number of licenses? Initially, no. You'd simply reorganize them into a structure. Would it improve understanding of the licenses? Yes. Understanding would increase exponentially, rather than linearly, as a person worked their way through. Would it eventually lead to a reduction in the number of licenses? Yes. A lot of them have trivial or insignificant change sets and making this obvious to all would create pressure to consolidate where appropriate.
Ok, but doesn't the sheer number also create pressure? Yes, but it may NOT always be appropriate, and there may be unexpected and undesirable results. Make thing clear FIRST, and THEN make changes, not the other way round.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
I've had the idea for a while that it would be cool to design some kind of formal language to describe licenses, so that you could apply logical rules to cancel out conflicting requirements and determine whether licenses are compatible with each other.
Sure, legalese is pretty "formal", but it's not computer-science *formal*. How cool would that be to encode laws and legal conditions such that they are provably effective?
Someone must have done something like this...
(That said, I've never really understood why people choose licenses other than BSD or GPL, since these seem to express some basic viewpoints on how F/OSS should work, but I guess people have their own reasons, which is fine with me actually.)
I represented an company that had developed a closed source software product that had incorporated several open source (but not GPL'ed) libraries, each released under a different license.
There was a transaction cost, in that the company had to pay my law firm to review each license to be sure the distribution of the product did not violate the license. Some of the licenses had attribution requirements, including one which required the verbatim reproduction of the open source license within the distribution. I advised my client as such, and they included that license within a readme file, complete with the glaring typos that were in the original.
The cost of a junior lawyer spending a few hours reviewing six different licenses (approx $300 per hour) was lower than recreating the code from scratch -- so it is hard to argue that the proliferation of licenses is problematic. My client was still better off than if it had to spend an extra week of development time authoring the libraries.
of corporate open source adopters, there is no issue, as they will not be selling and distributing the software. For those that do, open source licenses tend to cover many different products, whereas each closed product will have a different license. So, if nothing else, open source is slowly reducing the number of licenses you have to worry about.
"To those who are overly cautious, everything is impossible. "
Having just reviewed the Microsoft XPE OEM and Runtime licenses and a whole bunch of 'off-the-shelf' commercial software for some work I'm doing, navigating what you can and can't do with the software is not all that easy.... (vs what you are required to do under many FOSS licenses). Imagine the worst EULA you've ever seen, then change it randomly and apply a different restrictions to each application you're using with completely different conditions. Then put them all on one system.
The whole time I was thinking to myself this would be all so much easier if all this was under GPL....
(I'm no lawyer, (I don't even play one on TV) I was just looking at 'does our implementation make us subject to clause x'... etc.)
Now there's a way to make them seem evil. I've hardly ever seen the word "loyalist" without the word "paramilitaries" directly after it.
rock? Because when it comes right down to it I think that's all this poor analyst was looking for. Just admit it, you want to rock? You know Linus knows how to rock. John Hall looks fresh out of a Greatful Dead concert (although I was thinking more along the lines of AC/DC, but whatever man). Linux totally has the license to rock.
Quack, quack.
Sure. Try telling your landlord that you going to pay him in "reciprocal commitments".
I'm still not seeing why the OSI hasn't developed a CHART where each license is placed based upon what it allows and what it restricts.
No, this doesn't have to be a 2 dimensional line.
Then, any gaps would be easily seen and a line could be drawn saying "all licenses below this point are compatible with the GPL v2" or whatever license you're looking at.
Then there wouldn't be a question of which license to use. Just look for which one meets your minimal requirements.
I can see it now:
public MyLicense extends BSD implements Attribution;
or
public NPL extends GPL implements OwnerTakeback;
There is nothing so silly as other peoples traditions, and nothing so sacred as our own.
"What can be done to minimize multiple-license pain for corporate open source adopters?"
Why should corporate users get an easy ride ?
Corporate users are the ones who would likely turn on us and destroy the community if it would boost the next profit report by a few percent.
Its not about users its about the source code.
But i guess if it turns out that corporate users a big on giving constructive feedback, bug reports then i guess we should give a shit, but i expect they are too busy using to do anything else.
because UNLESS they are also DISTRIBUTING said software, they probably don't have to worry about the license very much. Especially if they stick to a GPL style license. If they are in the business of distributing software, then they damn well better have a clue on how to handle the terms of the licenses of the software they choose to use. At the end of the day, the free software world doesn't need the suits, it's the suits that need FOSS.
If only everyone used the Beer-Ware license.
Because everyone draws lines different places and threatens legal action if you cross those lines.
The cardinal rule of *business* relating to intellectual property law is that the licene means what the licensor says it means unless and untill it becomes worth fighting in court. I run a business. IANAL.
I actually see this complexity to be a good thing. It forces licenses to compete. And it raises the likelihood of lawsuits relating to the limits of each open source license. Lawsuits (as long as I am not involved) are a good thing because they provide points of reference as to legal limits of the licenses.
Does anyone here think that merely linking is sufficient to show derivation? WOuldn't this give OS vendors like Microsoft exclusive control over the development of applications for their platform? Why are these different?
LedgerSMB: Open source Accounting/ERP
If its 'open' its mine to do with as i please.
---- Booth was a patriot ----
I know when I'm faced with a bewildering array of different licenses that I can't keep track of,
I just download the software, use it, and get on with the rest of my day.
At a certain level of complexity, all you can do is zone out. I don't have time to become an
intellectual property lawyer at night school.
So yeah, radical simplification of the situation would be a good thing for all concerned.
Where are we going and why are we in a handbasket?
WHile what you say is exactly right for most OSI-approved licenses, there is at least one exception that I am aware of.
Larry Rosen's OSL requires distributing the source code of any software which is used by people outside your organization, at least by my lay reading of section 5 (IANAL). So it does seem wise to have lawyers read the licenses for hidden surprises of this sort. Of course, this doesn't add complexity for mere use because this is going to be the same for nearly every license out there (so you are just looking for exceptions).
In distribution it becomes a pain though....
LedgerSMB: Open source Accounting/ERP
2) Most users don't distribute
Therefore there is not much of added complexity...
Not to mention the fact that there may be 1000 open source licenses, that does not mean the projects with multiple license use more than 3 and the differences on the licenses in a single project tend not to be big, and it is very unlikely you would not get into one of the 10 most common ones.
Copyright infringement is "piracy" in the same way DRM is "consumer rape"
It seems *companies* that release a version of or part of their software as open source seem to have an aversion to using existing licenses. Too many of them take a common license, and then just change the name. This is also true for open-source foundations that are arms of the various companies. Consider:
* Apache Software License
* Apache License, 2.0
* Apple Public Source License
* Computer Associates Trusted Open Source License 1.1
* Eclipse Public License
* IBM Public License
* Intel Open Source License
* Jabber Open Source License
* Lucent Public License Version 1.02
* Mozilla Public License 1.1 (MPL)
* Qt Public License (QPL)
* RealNetworks Public Source License V1.0
* Sun Public License
* Zope Public License
And that list is selection from *just* the OSI-approved ones, never mind the rest of them touted as open but not approved. Is it the lawyers or marketing that drives this idea of taking a perfectly good license, making minor customizations, and stamping it with a brand name?
Well, you're pretty wrong.
/usr/portage/licenses/ |wc -l
Gentoo has 865 licenses covering the packages in their tree as of today:
$ ls -l
865
Closed source compliance costs are such that the company I work for has moved to "Open (Wallet) Licensing" (http://www.microsoft.com/licensing/programs/open/ default.mspx).
We effectively buy 2 windows licenses for every box (one OEM, one volume license), we even have to pay for non-MS boxes (you license every box 'capable of running windows' regardless of whether or not it does. I run Ubuntu and I'm still paying an annual fee to MS!!).
Yeah, our problem is the proliferation of FOSS licenses (all of which basically say "do whatever you want in-house").
As if companies read the EULAs of all the commercial software they buy and use? Aren't they all different as well? There's bound to be more than just thousands of commercial licenses.
What do companies do with commercial licenses? They generally presume certain things about it and generally try to behave accordingly. The only differences with F/OSS in a business environment is they might need to scan the license for suitability in a business environment one time before deciding to use it or not. (That's one of the few things that can 'get them' using F/OSS is that some licenses say "you should pay or donate if you're using this in a business, but it's free for personal use.") Otherwise, general 'best practices' when using F/OSS in a business should apply... don't try to sell it unless you know damn well you can. Modify it if you want, but don't try to sell it unless you follow the rules, and on and on...
It's not about the thousands of licenses. It's about knowing where you can and cannot step and most of it is pretty common-sense-like. The numeric abstract "thousands" is meant to frighten people. The reality is that barely a few different licenses would apply and each one should be considered on a case-by-case basis just as with commercial software. Are you installing your commercial OS in a virtual machine?
You better be sure you're able to do that legally!!
to minimize multiple-license pain for corporate open source adopters?
Words cannot describe the perfectly self-explanatory solution we have at our fingertips. So simple it is that no-one can see it, much less accept it.
What?
Why does everyone love the GPL? By forcing users of the code to obey...
One reason people love the GPL is that it has no use conditions, only distribution. The core ethic is that users are free to use the code for any purpose and to share the same with their neighbors.
BSD for me- it's basically public domain (the best solution IMO) but it strokes my ego by making sure my name is included in the code :)
The GPL will preserve your copyright notice too, unless you turn that copyright over to the FSF or other organization. Do you know anyone outside of Redmond that actually strips copyright notices from their source code?
Friends don't help friends install M$ junk.
Well, the deal with software, is that (at least for large companies), the cost of commercial license is a write off. At my previous jobs, we got a few douzan MSDN Premium with VS2005 Team Suite (something like 12-15 grands canadian....the canadian price is like 30% higher than USD btw, kindda funny) and it was written off on the corner of a table. Its unnoticeable in a large budget.
:)
The important part though, is let say you didn't read the license, and turns out that MSDN isn't a yearly fee, its every 6 months. Or that (as is amazingly common), you're using software from MSDN as production software (as opposed to development software), which, according to the EULA, can't be done. What do you do? Sign a few thousand dollars check in the worse case scenario. Big deal. If you used Vista Home Basic on virtual machines, again, sign a check and upgrade, its straightforward and about the worse that realistically happens
Now, let say I have a software with douzans of millions lines of code, and I use GPL software all over the place, because, like with commercial software, you didn't read the license, and you distribute it like nuts. Now, a couple of things can happen if you get caught(not in any particular order):
1) You deal with the guy who wrote the GPL stuff you're using for a commercial license. Then its like commercial software, no biggy.
2) You're asked to open source your stuff. I know the software we're writing at my current workplace gets several hundreds of thousands of dollars a shot, and is really nothing, except for ONE DLL that has 7 years of work in it, and its a raw algorythm (just an amazingly complex one). If that algorythm becomes easy to fetch, competitors will pop up left and right (we currently have virtually none), and we're out (not that we don't have a plan Bs in case it happens, but...). So thats worse than having to sign a 100000$ check. Not an option.
3) You have to take out the GPL stuff from your code. If its huge and integrated (no external library should ever be, but go tell that to 95% of the wannabe software architects out there), there's no taking it out. You'll have to spend months refactoring. Again, a lot worse than having to pay a few douzan thousand bucks to microsoft.
So all around, my point is, as a general rule, if you don't read licenses of commercial softwares, USUALY the consequences are a lot less dire than with many OSS licenses. Of course, I simply read the licenses and its never a problem, so no biggy for me, but there's a lot of idiots out there
I think copyright will fail because it serves the interests of those in the developed nations, not the interests of the developing nations.
Copyrights are supposed to encourage creaters to create, by giving them a limited monopoly on what they create. With the monopoly they can then attempt to receive compensation by selling what they create or copies thereof.
Also, those who do not prevent their population from having free and universal access to intellectual works will have more educated citizenry, and will see a rise in productivity as a result.
Fair Use should serve enough for this. With fair use a teacher could copy small parts of a work to pass out to students who then could see how something is done. Of course Fair Use means nothing now in the US.
Also, those cultures who attempt to impose barriers that prevent the proliferation of their cultural views will become marginalized, while those who encourage their culture to spread will find more allies and like-mindedness from the other cultures that do the same.
Agreed!
Falcon
Should there be a Law?
So what? That means nothing. Most licenses are not approved by OSI, and most open-source software authors do not give a damn about OSI.
The big boys might... but the vast majority of open-source (like the vast majority of businesses), are the "little people" who don't want to bother with (and probably don't like) corporate lawyers.
Everyone can standardize on the anti-business and anti-commerical GPLv3. The fact it was created specifically to attack Microsoft... that's just an added bonus.
From http://www.ibiblio.org/pub/linux/docs/HOWTO/Advoca cy
Nothing for 6-digit uids?
If a license says something like that, it is neither free nor open source. Neither the OSI nor the FSF will approve a license that directly restricts commercial use. If developers would simply use one of the standard licenses (like modified BSD or GPL), this would never be a problem.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
When are we going to get back to coding and stop being license cops?
Get a clue. The license does not matter. The attitude matters.
All the OSS licenses in the world will not help if the attitude about contributing is wrong.
This was inevitable. As soon as you believe in "intellectual property", it becomes a zero-sum game in which you HAVE to WIN over someone else and control their behavior. And this inevitably leads to a proliferation of legal maneuvers until the rate of return drops to zero, with everyone spending more time interpreting the legalities than coding.
Drop the licenses completely, STFU and get back to coding.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!