Slashdot Mirror
After 20 Years, OpenSSL Will Change To Apache License 2.0, Seeks Past Contributors (openssl.org)
After nearly 20 years and 31,000 commits, OpenSSL wants to change to Apache License v2.0. They're now tracking down all 400 contributors to sign new license agreements, a process expected to take several months. Slashdot reader rich_salz shares links to OpenSSL's official announcement (and their agreement-collecting web site).
"This re-licensing activity will make OpenSSL, already the world's most widely-used FOSS encryption software, more convenient to incorporate in the widest possible range of free and open source software," said Mishi Choudhary, Legal Director of Software Freedom Law Center and counsel to OpenSSL. "OpenSSL's team has carefully prepared for this re-licensing, and their process will be an outstanding example of 'how to do it right.'"
Click through for some comments on the significance of this move from the Linux Foundation, Intel, and Oracle.
Click through for some comments on the significance of this move from the Linux Foundation, Intel, and Oracle.
- "The Linux Foundation is excited to see the OpenSSL project re-licensing under the Apache License. Using a standard and well-understood license is a huge benefit when incorporating a FOSS project into other projects and products... this license move will further help to ensure it remains one of the most important and relied-upon open source projects in the world."
-- Nicko van Someren, Chief Technology Officer, the Linux Foundation
- "Oracle is proud to extend its collaboration with the OpenSSL Foundation by relicensing its contributions of elliptic curve cryptography. OpenSSL is a critical component in both Oracle products and the infrastructure of the Internet, and we strongly believe the increased use of cryptography fostered by OpenSSL will benefit the entire enterprise software community."
-- Jim Wright, Chief Architect of Open Source Policy, Strategy, Compliance and Alliances, Oracle
- "Intel is thrilled to see OpenSSL moving to the standard Apache 2.0 license, improving license compatibility within the Open Source ecosystem. This will help defragment the open source cryptography ecosystem, leading to stronger and more pervasive use of crypto to improve privacy and security in the global technology infrastructure."
-- Imad Sousou, Vice President and General Manager of the Open Source Technology Center, Intel
OpenSSL has 2 licenses. Must follow both, not one or the other!
About half of OpenSSL has some kind of BSD on steroids license. The other half has a homebrew open source BSD-style license made by the original author/contributor.
Ref: https://www.openssl.org/source/license.html
Some of the contributors are upset
Parent link (http://marc.info/?l=openbsd-tech&m=149028593819547) is highly informative.
The last sentence of the email is particularly enlightening:
If we do not hear from you, we will assume that you have no objection.
Even the most obnoxious EULAs do not assume consent if they cannot get your response.
I used to think the same before I talked to some legal people -- you might be surprised. Making a good-faith, reasonable effort to contact everyone involved and give them a chance to object, and get agreement from all significant contributors with the unknown portion driven down to a miniscule portion, and apparently it can be viable. It's not a situation I would count out without actually talking with an expert for each specific situation.
Especially since one of the licenses that all contributors have agreed to specifically states that the licence CANNOT BE CHANGED.