Slashdot Mirror
After 20 Years, OpenSSL Will Change To Apache License 2.0, Seeks Past Contributors (openssl.org)
After nearly 20 years and 31,000 commits, OpenSSL wants to change to Apache License v2.0. They're now tracking down all 400 contributors to sign new license agreements, a process expected to take several months. Slashdot reader rich_salz shares links to OpenSSL's official announcement (and their agreement-collecting web site).
"This re-licensing activity will make OpenSSL, already the world's most widely-used FOSS encryption software, more convenient to incorporate in the widest possible range of free and open source software," said Mishi Choudhary, Legal Director of Software Freedom Law Center and counsel to OpenSSL. "OpenSSL's team has carefully prepared for this re-licensing, and their process will be an outstanding example of 'how to do it right.'"
Click through for some comments on the significance of this move from the Linux Foundation, Intel, and Oracle.
Click through for some comments on the significance of this move from the Linux Foundation, Intel, and Oracle.
- "The Linux Foundation is excited to see the OpenSSL project re-licensing under the Apache License. Using a standard and well-understood license is a huge benefit when incorporating a FOSS project into other projects and products... this license move will further help to ensure it remains one of the most important and relied-upon open source projects in the world."
-- Nicko van Someren, Chief Technology Officer, the Linux Foundation
- "Oracle is proud to extend its collaboration with the OpenSSL Foundation by relicensing its contributions of elliptic curve cryptography. OpenSSL is a critical component in both Oracle products and the infrastructure of the Internet, and we strongly believe the increased use of cryptography fostered by OpenSSL will benefit the entire enterprise software community."
-- Jim Wright, Chief Architect of Open Source Policy, Strategy, Compliance and Alliances, Oracle
- "Intel is thrilled to see OpenSSL moving to the standard Apache 2.0 license, improving license compatibility within the Open Source ecosystem. This will help defragment the open source cryptography ecosystem, leading to stronger and more pervasive use of crypto to improve privacy and security in the global technology infrastructure."
-- Imad Sousou, Vice President and General Manager of the Open Source Technology Center, Intel
What was the old license model?
Some of the contributors are upset about the way that this license change is being pushed through. See
http://marc.info/?l=openbsd-tech&m=149028593819547
OpenSSL isn't under the GPL - it has its own unique, dual license.
#DeleteChrome
Finding hundreds of contributors and obtain a license change from them will not happen.
The only workable solution is just to change it and hope nobody will complain.
Yes, and I'm asking for the same permission to own all assets associated with openssl.org. If I don't hear back from you, I'll assume you have no objection.
I'm willing to do public domain, unlicense. I could be persuaded to go to 2-clause BSD, MIT, ISC but there is not really any way I'd be happy with Apache license. I wasn't that happy with the OpenSSL licenses when I contributed but there wasn't a choice. But now that I've been given some influence, I'm going to use it to decide what happens to my contributions.
This will likely end with my code being throw out and someone rewriting it, but I'd at least like to see how far I can take this.
...They're now tracking down all 400 contributors to sign new license agreements...
From what I read, OpenSSL are saying that if you have contributed, and you don't respond to their request to change the license on the code you contributed, OpenSSL will take your code and change the license on your code without your explicit permission.
.
I really hope I am reading it incorrectly, because I would expect better behavior from a security-oriented project. Far better behavior.
FUCK GNU HlPPlE SCUM!!!
DEATH T0 FREEDOM!!!!!!!!!
According to the Wikipedia page for LibreSSL (I glanced at the git repo and couldn't see a central LICENSE file in the root of the repository, so I assume it's headers per file) https://en.wikipedia.org/wiki/... the primary fork of OpenSSL is presently licensed as a combination of:
"Apache license 1.0, 4-clause BSD License, ISC license, and some are public domain"
I assume some of that is inherited from OpenSSL directly, and that the BSD fork would be closer to having key components replaced to allow for a functional core component set that is licensed in a modern BSD license.
Slashdot finally got around to reporting on this, and they don't even mention the controversy regarding relicencing the code without explicit permission of all contributors?
"We are going to repeal and replace the current license with something terrific. Everybody will love it."
Good luck getting that past 400 developers. The Freedom Coders may well have different ideas.
Seriously, though: The reasons given for needing the license change are highly suspect. OpenSSL is somehow "the world’s most popular SSL/TLS and cryptographic toolkit" while at the same time having a license that is holding it back. This doesn't pass the smell test. Something else is afoot.
some of the contributors are going to be dead.
I was under impression that license changes like this just didn't happen because it was impossible track down everyone and get them to agree.
IANAL but, you can't change someone's license on them. This is just piracy, and they're relying on the contributors being too poor, disinterested or dead to sue!
400 seems awfully low for a long running projecting if they are counting everyone who ever contributed a patch.....I just did a little poking, and they seem to have uids up to 1477
https://license.openssl.org/cgi-bin/lookup.py?uid=1477
Now maybe some are duplicates, but I would think there are a bunch of people who only sent in a single patch. I wonder if you posted a patch on the mailing list and one of the regulars grabbed it and put it in if you got credit and are being asked your opinion. OpenSSL was around well before all the "sign-off" stuff many projects have been doing for the last decade or so.
If the devs were okay with the previous licenses, what are they likely to object to in the proposed license?
I don't think I've ever heard anyone rant against Apache 2.0.
*sigh* back to work...
What's the existing license? Is this a migration from copyleft to a more permissive license, or is this a migration from an unusual license (some kind of openbsd license?) to something more standard?
Also:
Oracle is proud to extend its collaboration with the OpenSSL Foundation by relicensing its contributions of elliptic curve cryptography
What company that Oracle has bought originally contributed this?
Secession is the right of all sentient beings.
> I'm pretty sure both common law and civil law jurisdictions would side with a contributor who objects after the fact, even if they did get the notice.
If they got the notice, estoppel by acquiescence may apply. "Estoppel by acquiescence" means one may not sue later if you were given a clear opportunity to object and chose to not object in any way. Georgia v. South Carolina is a well-known case. Georgia had legal claim to certain land based on a treaty. For many years, South Carolina treated it as part of South Carolina, levying taxes in the area, etc.Georgia did not object during these many years. Later Georgia attempted to assert their claim to the area. The court ruled that Georgia's failure to object for many years barred the action - their silence was basically implied permission.
A related concept is laches. Laches means you have to assert your rights in a reasonable time frame, or not at all - an author who files suit regarding the license change ten years from now will probably be barred by laches.
Anything that Oracle favors is probably bad for everyone else somehow...
There are many ways to allow for the possibility that the license may need to be changed in the future, without allowing just anyone to pick any license they choose.
The standard GPL license has a clause allowing the code to be distributed under the current license *or any future version* of the GPL license.
One could ask permission to distribute it under any OSI-approved license. I've received that permission before, the author granted me permission to use "any open source license", and the OSI list is reasonable, third-party definition of which licenses qualify as "any open source license".
One could say that the license may be changed be unanimous agreement of the foundation board of directors, by 2/3rds vote of recent contributors, or some other planned method.
Everything it provides will be integrated into systemd anyway, they need it as part of the upcoming systemd web browser.
Mind the frickin' laser...
The standard GPL license has a clause allowing the code to be distributed under the current license *or any future version* of the GPL license.
That's not part of the GPL AFAIK, rather it's the language some developers (not all) put into the code files that they are licensing. Personally, I don't do that and any version of the GPL that does auto-include such language is something I'd avoid. Sure, I trust the license that I am using now but I don't necessarily trust a newer version to do something I don't approve of.
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
The OpenSSL group here is clearly aware that they do not hold the copyrights here, or have permission to change the license.
that would be precisely why they are asking permission, no duh. if they held the copyrights then they would not need to ask permission from the contributors
Some people like the GPL provisions that require modifications and other extensions to also be released under the same license. Reasonable people can argue over whether or not those provisions are a "good thing" for open source users and/or developers. I was once in the "GPL is better because it makes more software more free" camp but I now find myself in the "it's really people that ought to be free" camp and like the AL2 license better because it is less restrictive on actual people.
My post may have been a bit unclear. "Or any later version" is indeed an option used by many GPL programs, but certainly not all. GNU recommends including that. I don't in my software, because a) I object to the patent terms of GPLv3, as actually written and b) I no longer trust GNU to avoid adding objectionable clauses in future versions.