Slashdot Mirror
After 20 Years, OpenSSL Will Change To Apache License 2.0, Seeks Past Contributors (openssl.org)
After nearly 20 years and 31,000 commits, OpenSSL wants to change to Apache License v2.0. They're now tracking down all 400 contributors to sign new license agreements, a process expected to take several months. Slashdot reader rich_salz shares links to OpenSSL's official announcement (and their agreement-collecting web site).
"This re-licensing activity will make OpenSSL, already the world's most widely-used FOSS encryption software, more convenient to incorporate in the widest possible range of free and open source software," said Mishi Choudhary, Legal Director of Software Freedom Law Center and counsel to OpenSSL. "OpenSSL's team has carefully prepared for this re-licensing, and their process will be an outstanding example of 'how to do it right.'"
Click through for some comments on the significance of this move from the Linux Foundation, Intel, and Oracle.
Click through for some comments on the significance of this move from the Linux Foundation, Intel, and Oracle.
- "The Linux Foundation is excited to see the OpenSSL project re-licensing under the Apache License. Using a standard and well-understood license is a huge benefit when incorporating a FOSS project into other projects and products... this license move will further help to ensure it remains one of the most important and relied-upon open source projects in the world."
-- Nicko van Someren, Chief Technology Officer, the Linux Foundation
- "Oracle is proud to extend its collaboration with the OpenSSL Foundation by relicensing its contributions of elliptic curve cryptography. OpenSSL is a critical component in both Oracle products and the infrastructure of the Internet, and we strongly believe the increased use of cryptography fostered by OpenSSL will benefit the entire enterprise software community."
-- Jim Wright, Chief Architect of Open Source Policy, Strategy, Compliance and Alliances, Oracle
- "Intel is thrilled to see OpenSSL moving to the standard Apache 2.0 license, improving license compatibility within the Open Source ecosystem. This will help defragment the open source cryptography ecosystem, leading to stronger and more pervasive use of crypto to improve privacy and security in the global technology infrastructure."
-- Imad Sousou, Vice President and General Manager of the Open Source Technology Center, Intel
What was the old license model?
Some of the contributors are upset about the way that this license change is being pushed through. See
http://marc.info/?l=openbsd-tech&m=149028593819547
OpenSSL isn't under the GPL - it has its own unique, dual license.
#DeleteChrome
If you get enough, you can rewrite the remaining bits.
Yes, and I'm asking for the same permission to own all assets associated with openssl.org. If I don't hear back from you, I'll assume you have no objection.
I'm willing to do public domain, unlicense. I could be persuaded to go to 2-clause BSD, MIT, ISC but there is not really any way I'd be happy with Apache license. I wasn't that happy with the OpenSSL licenses when I contributed but there wasn't a choice. But now that I've been given some influence, I'm going to use it to decide what happens to my contributions.
This will likely end with my code being throw out and someone rewriting it, but I'd at least like to see how far I can take this.
Of course it won't happen. What's the likelihood that all 400 are still alive and mentally competent after a couple of decades?
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
...They're now tracking down all 400 contributors to sign new license agreements...
From what I read, OpenSSL are saying that if you have contributed, and you don't respond to their request to change the license on the code you contributed, OpenSSL will take your code and change the license on your code without your explicit permission.
.
I really hope I am reading it incorrectly, because I would expect better behavior from a security-oriented project. Far better behavior.
Unwinding it all to figure out who contributed to what source files is the hardest part. I suppose at
In reality my guess that of the 400 contributors, a much smaller number contributed to the bulk of the code. Some of the contributors might have only made one or two small contributions that would be easy to work around if they didn't give consent or they could not be located.
All I need to be suspicious is the mention that Oracle is involved.
If the devs were okay with the previous licenses, what are they likely to object to in the proposed license?
I don't think I've ever heard anyone rant against Apache 2.0.
*sigh* back to work...
It's why the FSF is so very careful that the GPL grants licenses to existing users, and are transitive so that changes are _also_ under GPL and free for publication and modificaiton. It's also why various "you must advertise our name on this software" or "you may not make any changes to this software" have repeatedly proven confusing and dangerous to use.
Of course it won't happen. What's the likelihood that all 400 are still alive and mentally competent after a couple of decades?
Have you ever read the OpenSSL code? I don't think lack of mental competency has ever stopped anyone from contributing in the past.
There are lots of dups in there. So far I've received four different requests to OK the license change under different IDs.
What's the existing license? Is this a migration from copyleft to a more permissive license, or is this a migration from an unusual license (some kind of openbsd license?) to something more standard?
Also:
Oracle is proud to extend its collaboration with the OpenSSL Foundation by relicensing its contributions of elliptic curve cryptography
What company that Oracle has bought originally contributed this?
Secession is the right of all sentient beings.
> I'm pretty sure both common law and civil law jurisdictions would side with a contributor who objects after the fact, even if they did get the notice.
If they got the notice, estoppel by acquiescence may apply. "Estoppel by acquiescence" means one may not sue later if you were given a clear opportunity to object and chose to not object in any way. Georgia v. South Carolina is a well-known case. Georgia had legal claim to certain land based on a treaty. For many years, South Carolina treated it as part of South Carolina, levying taxes in the area, etc.Georgia did not object during these many years. Later Georgia attempted to assert their claim to the area. The court ruled that Georgia's failure to object for many years barred the action - their silence was basically implied permission.
A related concept is laches. Laches means you have to assert your rights in a reasonable time frame, or not at all - an author who files suit regarding the license change ten years from now will probably be barred by laches.
There are many ways to allow for the possibility that the license may need to be changed in the future, without allowing just anyone to pick any license they choose.
The standard GPL license has a clause allowing the code to be distributed under the current license *or any future version* of the GPL license.
One could ask permission to distribute it under any OSI-approved license. I've received that permission before, the author granted me permission to use "any open source license", and the OSI list is reasonable, third-party definition of which licenses qualify as "any open source license".
One could say that the license may be changed be unanimous agreement of the foundation board of directors, by 2/3rds vote of recent contributors, or some other planned method.
How the hell do you re-write something like that? An "if" statement keys on the value of a single variable and conditionally executes a function. There are some things for which there is only one solution. Someone might suggest "just cold-room it!" But how are they supposed to do that?
You mean cleanroom. Copyright protects one particular expression (implementation) not the underlying idea (functionality), so the point is not necessarily to come up with a different solution but to document that it has been done independently. Yes, that means they must find an "untainted" developer to write the new code but you can in great detail describe the functionality as long as you don't impose a particular implementation. It's even been done "after the fact" as evidence:
The court relied heavily on evidence NEC presented that compared a "clean room'' program with both the V20/30 and Intel 8086/88 microcode. NEC hired an independent engineer (Gary Davidian) to develop a set of microcode for the V20/30 without access to any other microcode. Because Davidian's version of the microcode was similar in many regards to both the Intel and NEC microcodes, the court found it likely that those similarities were dictated not by copying of Intel's microcode, but rather by functional constraints of the hardware, the architecture, and the need for 8086/88 compatibility.
The documentation is a pain in the butt, but the legal reasoning around it isn't so bad.
Live today, because you never know what tomorrow brings
Unwinding it all to figure out who contributed to what source files is the hardest part. I suppose at
Yeah, if only we had a tool that would track who wrote which line of code in which file. Something like a Version Control System.
I always hear this refrain in situations like this. But suppose one of the contributions went something like this:
if (flag1 != "value") { doIt(); }
How the hell do you re-write something like that? An "if" statement keys on the value of a single variable and conditionally executes a function. There are some things for which there is only one solution.
If there's truly only one possible solution for something that simple, then it isn't copyrightable anyway. Copyright requires some amount of creative expression, and something like that wouldn't meet the minimum level of creativity.
Everything it provides will be integrated into systemd anyway, they need it as part of the upcoming systemd web browser.
Mind the frickin' laser...
The standard GPL license has a clause allowing the code to be distributed under the current license *or any future version* of the GPL license.
That's not part of the GPL AFAIK, rather it's the language some developers (not all) put into the code files that they are licensing. Personally, I don't do that and any version of the GPL that does auto-include such language is something I'd avoid. Sure, I trust the license that I am using now but I don't necessarily trust a newer version to do something I don't approve of.
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
My post may have been a bit unclear. "Or any later version" is indeed an option used by many GPL programs, but certainly not all. GNU recommends including that. I don't in my software, because a) I object to the patent terms of GPLv3, as actually written and b) I no longer trust GNU to avoid adding objectionable clauses in future versions.
while (flag1 != "value")
{
doIt();
break;
}
"It's such a fine line between stupid and clever" -- David St. Hubbins, Spinal Tap
The tools we used to do this are at https://github.com/openssl/too...