12 ms·

Theo de Raadt on LLVM license change

142 points by protomyth 10y ago

TempleOS 10y ago
I have divine intellect. I wrote a 20,000 line of code x86_64 HolyC compiler/assembler/unassembler that operates JIT and AOT. There is no possible way my code in any way could be mistaken for gcc. There is no danger they can change their code to do fraud against me. It's really obvious to any programmer. Frasier is just a monkey-nigger flinging his shit.
d33 10y ago
A bit of reminder on who Theo is: > Theo de Raadt (/ˈθiː.oʊ dɛˈrɔːt/; Dutch: [ˈteː.o dɛˈraːt]; born May 19, 1968) is a software engineer who lives in Calgary, Alberta, Canada. He is the founder and leader of the OpenBSD and OpenSSH projects, and was also a founding member of the NetBSD project.
- gonzo 10y ago
  And was kicked out of the NetBSD project. This is the rest of the origin story for OpenBSD.
- dleslie 10y ago
  Living in Canada allowed him to avoid the USA's onerous export restrictions on strong encryption; at a time when good, consumer-accessable encryption was expensive and patent-encumbered. The 'net is secure in no small part to his efforts and that of the rest of the OpenBSD team.
  - nickpsecurity 10y ago
    You mean DJB, Zimmerman, and others fighting the governments to change the status quo encryption policy followed by deployment of higher-quality stuff than average proprietary in FreeBSD and Linux that got widely adopted by most of the Internet? Nobody has ever showed me evidence that Theo or OpenBSD had any impact on the security of the Internet as a whole. Maybe on specific users of OpenBSD or the developers' higher-quality software. Not the big picture, though. I'm open to specific examples if you have them of widespread changes in INFOSEC or massive adoption of better tech due to Theo de Raadt. EDIT: I'm aware of many good apps they've made. To clarify, my comment is addressing this broad claim: "The 'net is secure in no small part to his efforts and that of the rest of the OpenBSD team." OpenSSH might get credit due to massive use. Good example. Past that, what else does most of the net on client side (mainly Windows & Mac) or server-side (mainly Win, FreeBSD, and Linux) depend on from OpenBSD developers?
    - tonyarkles 10y ago
      OpenSSH?
    - notaplumber 10y ago
      http://www.openbsd.org/innovations.html http://www.openbsd.org/innovations.html
    - pyvpx 10y ago
      Androids libc?
      - nickpsecurity 10y ago
        OpenBSD team made that? You got a link?
        Sanddancer 10y ago
        Google used bits and pieces of various BSD libcs in bionic. It's not definitive, but wiki has a list. https://en.m.wikipedia.org/wiki/Bionic_(software) https://en.m.wikipedia.org/wiki/Bionic_(software)
    - dleslie 10y ago
      OpenBSD led by example, being secure by default and at the expense of other considerations. And yes, that wee piece of software that is the secure gateway of choice and has been for a great length of time; among a great many other innovations mentioned in the link in another reply.
freedomtaco 10y ago
Theo's right of course. Paradoxically, projects on github flourish because contributors and users by in large ignore the licenses. Granted, licenses are extremely important to protect intellectual property but nothing kills contributions to open source more than bureaucracy.
- tingol 10y ago
  What makes you think of all the things ignoring the licenses (citation needed) is the one that made github flourish?
  - freedomtaco 10y ago
    I won't bother contributing to a project if I have to jump through hoops. The Github ecosystem removes these hoops. The license is a secondary concern for in-house software.
    - tingol 10y ago
      I still don't see what you mean by this. All of the top projects on github have pretty clear licenses which are automatically accepted by you (the contributor). In fact if you choose not to specify a license your work counts as copyrighted (as per github licensing documentation). So Github doesn't really remove any "hoops".
deleted 10y ago
[deleted]
robert_tweed 10y ago
Reproducing the text because the site is under too much load and Coral Cache can't resolve it: List: openbsd-misc Subject: Re: LLVM license change From: "Theo de Raadt" <deraadt () openbsd ! org> Date: 2016-09-28 4:27:44 Message-ID: 91077.1475036864 () cvs ! openbsd ! org [Download message RAW] > And that is because corporate "contributor-wannabes" put pressure on the > LLVM foundation. > http://lists.llvm.org/pipermail/llvm-dev/2015-October/091536.html > > It does say "this is an RFC" but that was last year. We are now in this > year: > http://lists.llvm.org/pipermail/llvm-dev/2016-September/104778.html > > What I particularly do not like is the "IANAL but let's do it anyway" > drift emanating from a lot of high profile developers there. Well, I hope they do it. And then -- I hope a year or two later, some author of a component (especially one from Europe where the moral rights of an author still carries substantial weight) submarines the new licence, surfacing to indicate that they never signed off on the additional terms applied to them as a significant author, and will accept no cash to solve the problem. Then they are dead in the water. A cataclysm like CSRG went through. Then a fork of code on the original license can flourish. A fork based upon the last free version -- but let's remember that is the history of another piece of important software... So this problem could be fixed, if enough people care. In this situation, I suspect a few people are being paid a lot of wages to act as agents permitting theft from their co-contributors. They worked with others but now they are ready to steal from them. A list of all contributers (and every single one of them must agree) has not been published, so it is really likely this is a well-financed effort being performed by paralegals. Meanwhile day by day that list of contributors operating under the existing model is growing.. Someone is hoping they can get away with copyright theft. Want to have fun? Submit a major diff, which (seperately) in the submission says you'll never agree. Eventually most large projects find their inner Xfree86, I'm afraid to say.
- shadowmint 10y ago
  It's hard to have any idea what that means without the preceding context: > > > What does the OpenBSD community think about the LLVM proposal to move > > > to the Apache license? > > > > > > http://lists.llvm.org/pipermail/llvm-dev/2016-September/104778.html > > > > If LLVM would move to the Apache 2 license, we would become unable > > to use versions released after that change, and would be stuck with > > version released before the change, just like we are stuck with > > pre-GPLv3 gcc now. So it would be very bad for us. > > > > See http://www.openbsd.org/policy.html : > > > > Apache > > The original Apache license was similar to the Berkeley license, > > but source code published under version 2 of the Apache license > > is subject to additional restrictions and cannot be included > > into OpenBSD. > > > > In a nutshell, OpenBSD does not consider software released under > > Apache 2 to be free software. At least not free enough for us
StreamBright 10y ago
Could somebody tl;dr me what is going on with LLVM and why the new licensing would be bad according to Theo?
- lambda 10y ago
  LLVM wants to switch from a BSD-style license to Apache 2.0, with a few exceptions, one allowing use with GPLv2 code, another allowing the bits of compiler-rt and other components that get built into binaries to be redistributed without restriction. The main benefit of Apache 2.0 is that it includes a patent grant as well. Right now, LLVM relies on a custom "developer agreement" for anyone who contributes code that includes a grant of patent rights, but it's kind of vague and fuzzy and so makes it hard for some people to contribute, and the license itself doesn't actually mention patents at all: http://lists.llvm.org/pipermail/llvm-dev/2015-October/091536.html http://lists.llvm.org/pipermail/llvm-dev/2015-October/091536... Theo objects to any license that applies more restrictions than the original BSD license. OpenBSD makes an exception for GPLv2 licensed utilities that have been traditionally shipped with BSDs that there's not a good replacement for, but has stopped upgrading things that have moved to GPLv3 and apparently objects to the Apache license as well.
  - StreamBright 10y ago
    Thank you very much for the detailed description. Makes sense now.
  - saurik 10y ago
    The existing patent agreements seem to make the current license not comparable BSD but instead comparable to an awkward or even apparently extreme Apache 2.0, so isn't this about in practice removing restrictions, not adding restrictions? (This thought process is backed up by their stated reasoning and the kinds of contributors that are supposedly complaining.)
    - drewcrawford 10y ago
      "Additional restrictions" can be funny. You may recall the FSF's position that the app store EULA placed "additional restrictions" on the GPL, a position that was and remains controversial. In this case, it is a little harder to understand OpenBSD's interpretation of additional restrictions because they haven't listed their objections in any centralized place, but from reading around, they seem to believe: * "You must cause any modified files to carry prominent notices stating that You changed the files" is an additional restriction * "any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License" is an additional restriction * The sheer length and complexity of the Apache license suggests to them there are other additional restrictions buried in there somewhere
kod 10y ago
Theo deRaadt complaining about "copyright theft" is hilarious given his original stance on the ipfilter debacle.
- TheRealPomax 10y ago
  then again, we don't pat people on the back for holding on to their odd views, we congratulate them for coming to new realizations and acting on those. So... no, not really. It's not even hypocritical. It's just someone who is currently raising a perfectly valid argument, and his arguments in previous debates have literally nothing to do with the current, legally constrained, discussion around events that appear to have been put in place and moved forward without buying from all parties involved.
- mrweasel 10y ago
  I might very well be wrong, but I believed that the licensing of the IPFilter code, and the clarification of the attached license was part of the reason that OpenBSD, and Theo, is so much against complex licenses. While better than the GPL, version 2 and 3, in the sense that it's shorter, the Apache 2 license is still much more complex than the ISC or the BSD/MIT licenses. Another part of the issue, for some developers at least, is that the Apache 2 license sort of acknowledges that software patents are a thing. So if you disagree that companies should be allowed to patent software, mathematics and processes, you might not pick a license that validates the existence of those patents.
  - icebraining 10y ago
    So if you disagree that companies should be allowed to patent software, mathematics and processes, you might not pick a license that validates the existence of those patents. This sounds absurd to me. Software patents don't go away because one stops believing in them. Either the courts enforce them or not.
    - fungos 10y ago
      Sure, but I see the idea as a kind of boycott/protest. I disagree with patents, mainly software patents, consequently I will never use a license that consider patents.
Analemma_ 10y ago
Loaded language and feverish paranoia from Theo de Raadt? I'm shocked, shocked.
- psibi 10y ago
  As someone who doesn't follow the BSD development nor the LLVM, I don't know whether to take this as a sarcastic comment or a serious one.
  - sneak 10y ago
    Theo is known to like to showboat.
- zeeboo 10y ago
  Funny because Theo didn't say either of the quotes your parent was talking about.
- sctb 10y ago
  We detached this subthread from https://news.ycombinator.com/item?id=12618071 https://news.ycombinator.com/item?id=12618071 and marked it off-topic.
maxlybbert 10y ago
It's common for open source projects to change licenses. To be honest, I'm pretty sure that most projects have set the bar much higher than it legally is. In other words, I think de Raadt's fantasy isn't going to happen, and if it did, the fallout would likely be that many projects would lose the ability to enforce their licenses. Usually, when a project changes its license, it either tries to get permission from each contributor; or it makes an announcement that if any contributor objects, they will remove that person's contributions on request. But US law doesn't actually require that. In the US ( http://copyright.universityofcalifornia.edu/ownership/joint-works.html http://copyright.universityofcalifornia.edu/ownership/joint-... ): "Each joint author has the right to exercise any or all of the exclusive rights inherent in the joint work. Each author may: "• Grant third parties permission to use the work on a nonexclusive basis without the consent of other joint authors "• Transfer his or her entire ownership interest to another person without the other joint authors' consent". In other words, unless you have some kind of enforceable agreement between all contributors, any contributor can relicense the work, without the consent of the other contributors. I'm not sure whether the GPL qualifies as the kind of agreement that could prevent this; the FSF has spent years saying the GPL doesn't meet all the standard requirements of a contract because it doesn't need to be a contract. The FSF famously requires contributors to transfer their copyright interest to the FSF because Stallman says an attorney told him that makes it easier to enforce the GPL. Or, as Eben Moglen says ( https://www.gnu.org/licenses/why-assign.en.html https://www.gnu.org/licenses/why-assign.en.html ): "If there are multiple authors of a copyrighted work, successful enforcement depends on having the cooperation of all authors. "... [I]n order to be able to enforce the GPL most effectively, FSF requires that each author of code incorporated in FSF projects provide a copyright assignment, and, where appropriate, a disclaimer of any work-for-hire ownership claims by the programmer's employer." Many open source licenses other than the GPL don't have any chance of qualifying as the kind of agreement that could prevent a single contributor from relicensing the project on a whim. Also note that "contributor" doesn't necessarily mean to "contributor to the parent project." I haven't been able to find any legal reason somebody can't fork a project (following the license), make enough changes to become a joint copyright owner as far as their fork is concerned, and then relicense the fork. I guess the original contributors would also be joint copyright holders as far as the fork is concerned, and could relicense the fork as well. I'm not sure where that would end; and I'm glad that so far nobody's been creative enough to start such a battle. So, back to LLVM: Apple is, without question, a joint copyright holder and can relicense the code as desired. De Raadt's idea is that a European could say "well, the relicensing was OK under US law, but not under European law." But I don't see how moral rights would prevent relicensing. The Berne Convention establishes moral rights as ( https://en.wikipedia.org/wiki/Moral_rights https://en.wikipedia.org/wiki/Moral_rights ): "Independent of the author's economic rights, and even after the transfer of the said rights, the author shall have the right to claim authorship of the work and to object to any distortion, modification of, or other derogatory action in relation to the said work, which would be prejudicial to the author's honor or reputation." Note, (1) that is "independent of an author's economic rights" and (2) the contributor has the ability to object to any modification, mutilation, distortion, etc., of the work; not of the terms the work is distributed under. Countries can establish their own idea of moral rights, but I'm pretty sure they will follow the Berne Convention's definition pretty closely. So I would predict the outcome would be a court opinion that any contributor has the right to change the license, and that moral rights aren't the right tool to stop a relicensing. And if anybody can fork, become a contributor in the fork, and relicense the fork, I don't see how anyone can enforce any license restrictions.
FiloSottile 10y ago
All the comments here seem to focus on Theo, the Apache license vs. the BSD one, and for some reason the OpenBSD policy. But my understanding of that email is about the irregularity of a unilateral change of license. The contributors own their work and licensed it under one license, and the project wants to change it without doing the Herculean job of getting permission from all. I think Theo is correct there saying that there is a risk that one of those contributors will then come out of the woods and wreak havoc, risking a forced fork from the relicense point. IANAL, but "you don't change the license" is one of the few things I was taught.
- kr7 10y ago
  License changes are not unheard of. Wine changed from the MIT license to LGPL without all of the developer's support.
  - lukeschlather 10y ago
    That's fine within the terms of the MIT license. It's not okay to relicense LGPL to MIT without author consent.
    - the_mitsuhiko 10y ago
      You can't do that but you can do further contributions under the LGPL which essentially makes it an LGPL project.
      - jsmthrowaway 10y ago
        What provision of the MIT license prevents it? My understanding is that MIT -> GPL is legal as long as the required notice is kept for MIT compliance, since MIT is a subset of GPL.
        protomyth 10y ago
        What provision of the MIT License allows it? By default it is prevented in a copyrighted work. I don't think the sublicense clause covers it.
Koshkin 10y ago
Everybody enjoys free (as in "freedom") software. Turns out, even quality-wise free software is often much better than non-free, closed-source software. On the other hand, it may be hard to really understand the rationale behind it. The idea goes against the principles of capitalism (based on property rights). Also, if it is completely OK for hardware design to be proprietary, why should it not be OK for software? What is so special about it? The arguments put forward by proponents of free software do not seem very convincing, and sometimes their personalities do not help attracting people to their cause. Often, this ideal becomes a nuisance even in the world of open source. If you want to use Debian, for instance, you are pretty much forced to use "non-free" repositories (or a "non-free" Debian re-distribution) for your setup to be useful.
- gwright 10y ago
  What principle of capitalism is being violated? If anything, the freedom to set a price, even $0 if you so choose, sounds like the free market at work.
  - Koshkin 10y ago
    The issue has never been about price.
    - gwright 10y ago
      OK, then what principle of capitalism are you referring to?
      - Koshkin 10y ago
        Property rights. The "free software" principle proclaims that software (possibly, among other things) should be "freed" from the possibility of being anyone's private property. (This also somehow gets mixed with this odd idea that software should be considered a form of "free speech".)
        10y ago
sneak 10y ago
lol copyright.
- sctb 10y ago
  We've asked you not to comment unsubstantively like this, and we ban accounts that continue to do so. Please stop.
  - sneak 10y ago
    Apologies; I will. Perhaps I assumed too much context. Through my use of significantly outdated slang I was hoping to communicate something along the lines of "almost the entirety of the internet functions simply because almost all people ignore the legal make-believe that is intellectual property", and my comment was an attempt at a tongue-in-cheek reminder of this. Regardless, I won't comment further. Message received.
Someone 10y ago
http://llvm.org/docs/DeveloperPolicy.html#copyright http://llvm.org/docs/DeveloperPolicy.html#copyright: "The LLVM project does not require copyright assignments, which means that the copyright for the code in the project is held by its respective contributors who have each agreed to release their contributed code under the terms of the LLVM License. An implication of this is that the LLVM license is unlikely to ever change: changing it would require tracking down all the contributors to LLVM and getting them to agree that a license change is acceptable for their contribution. Since there are no plans to change the license, this is not a cause for concern. As a contributor to the project, this means that you (or your company) retain ownership of the code you contribute, that it cannot be used in a way that contradicts the license (which is a liberal BSD-style license), and that the license for your contributions won’t change without your approval in the future." OOPS.
- JoshTriplett 10y ago
  The LLVM license (the UofI/NCSA license) is permissive, and thus compatible with just about everything, including the Apache 2.0 license. All the existing code can stay under the old license unless someone agrees to the new one. New contributions can go under the new license. The effective license of the codebase will become Apache 2.0, with some pieces still available under the previous permissive license.
  - notaplumber 10y ago
    This is considered a dick move for a project to make, often this means any non-trivial changes to existing code will be under the more restrictive licence, with no backward compatibility, preventing such changes from being incorporated by the original authors or anyone perusing a fork of the originally permissive codebase. A common example of this kind of behaviour is GPL proponents forking BSD or other similiarly licensed software, and exclusively wrapping their contributions to it under the GPLv3.
    - JoshTriplett 10y ago
      A license change certainly shouldn't happen lightly, or without consulting the community. In this case, it looks like an extensively considered decision with substantial community feedback. And patent lawsuits hurt, so as reasons to change licenses go, that seems like a pretty good one.
DannyBee 10y ago
I'm not sure why anyone thinks there will not be a real license change process. There will. This is just the stage of settling the question of what the license should be. Everyone is quite aware of the work it will take to actually change the license (I've managed the process for a number of large projects before) and random commentary from Theo that it will just be unilaterally changed is simply wrong. Chris's email even says this " Once we reach an agreement on the path to take, we can start talking about logistics of how to get there." As for the corporate wannabes comment, the truth is that folks have gone out of their way to talk to both users and contributors, at the developer conference and elsewhere (and in fact, we've spent a year trying to come up with licensing solutions to ensure we don't cause problems for various one off users, whereas most projects who have relicensed usually just told them tough luck). Past that, I'll be honest:I'm pretty uninterested in what a bunch of random people on an unrelated mailing list, who don't participate in the community at all, want to think. Especially when they have pretty much no data and have never bothered to simply ask questions on the llvm mailing list in the thread (or at the developer conference, or...), like others did. If they have real concerns, they are welcome to raise them in any of the normal ways.
johncolanduoni 10y ago
I'm confused. The post he's responding to is just saying that they want to move to the Apache 2.0 license if possible. Chris certainly doesn't seem to be assuming they can just flick a switch and make it happen, considering he talks about "logistics" and is pretty clear it is still in the discussion stage. Is it a dick move just to ask the contributors if they're willing to provide the code under the Apache 2.0 license so people can use LLVM without worrying about being sued for patent infringement? This looks to me like Apple and other corporate contributors with large patent portfolios giving users without such bargaining chips some protections from litigation. I find it hard to see that as a bad thing, unless they were in fact deciding to pretend they own the copyright of the whole project and dare contributors to sue them. Thus far I see no evidence of that.
Keyframe 10y ago
Is dual license a possibility?
- petertodd 10y ago
  Not really. The anti-patent protections Apache provides don't work if the patent holder has the option to use the license without those protections instead. I believe this is why it's common for projects to dual-license under Apache and GPLv3 - both licenses have anti-patent provisions.
  - eridius 10y ago
    But it's not the patent holder that uses the license at all. It's the downstream user. Any downstream user would be protected by the patent clause as long as they're using the Apache 2.0 license regardless of what the patent holder wishes.
    - petertodd 10y ago
      Hmm. That's a good point; I've probably misunderstood that. Thanks! I'll do some more research.
notaplumber 10y ago
OpenBSD's been around for a long time, it would be unwise to dismiss these concerns, especially considering they've demonstrated this has happened before. LLVM/clang was recently imported into OpenBSD and is being brought into shape to potentially replace GCC, having OpenBSD developers eyes on a codebase has also historically been a good thing.. I think a future without their input will be bleak.
libman 10y ago
I got -15 karma on this site for saying the same thing.

142 points by protomyth 10y ago

I have divine intellect. I wrote a 20,000 line of code x86_64 HolyC compiler/assembler/unassembler that operates JIT and AOT. There is no possible way my code in any way could be mistaken for gcc. There is no danger they can change their code to do fraud against me. It's really obvious to any programmer. Frasier is just a monkey-nigger flinging his shit.

d33 10y ago

A bit of reminder on who Theo is: > Theo de Raadt (/ˈθiː.oʊ dɛˈrɔːt/; Dutch: [ˈteː.o dɛˈraːt]; born May 19, 1968) is a software engineer who lives in Calgary, Alberta, Canada. He is the founder and leader of the OpenBSD and OpenSSH projects, and was also a founding member of the NetBSD project.

gonzo 10y ago
And was kicked out of the NetBSD project. This is the rest of the origin story for OpenBSD.
dleslie 10y ago
Living in Canada allowed him to avoid the USA's onerous export restrictions on strong encryption; at a time when good, consumer-accessable encryption was expensive and patent-encumbered. The 'net is secure in no small part to his efforts and that of the rest of the OpenBSD team.
- nickpsecurity 10y ago
  You mean DJB, Zimmerman, and others fighting the governments to change the status quo encryption policy followed by deployment of higher-quality stuff than average proprietary in FreeBSD and Linux that got widely adopted by most of the Internet? Nobody has ever showed me evidence that Theo or OpenBSD had any impact on the security of the Internet as a whole. Maybe on specific users of OpenBSD or the developers' higher-quality software. Not the big picture, though. I'm open to specific examples if you have them of widespread changes in INFOSEC or massive adoption of better tech due to Theo de Raadt. EDIT: I'm aware of many good apps they've made. To clarify, my comment is addressing this broad claim: "The 'net is secure in no small part to his efforts and that of the rest of the OpenBSD team." OpenSSH might get credit due to massive use. Good example. Past that, what else does most of the net on client side (mainly Windows & Mac) or server-side (mainly Win, FreeBSD, and Linux) depend on from OpenBSD developers?
  - tonyarkles 10y ago
    OpenSSH?
  - notaplumber 10y ago
    http://www.openbsd.org/innovations.html http://www.openbsd.org/innovations.html
  - pyvpx 10y ago
    Androids libc?
    - nickpsecurity 10y ago
      OpenBSD team made that? You got a link?
      - Sanddancer 10y ago
        Google used bits and pieces of various BSD libcs in bionic. It's not definitive, but wiki has a list. https://en.m.wikipedia.org/wiki/Bionic_(software) https://en.m.wikipedia.org/wiki/Bionic_(software)
  - dleslie 10y ago
    OpenBSD led by example, being secure by default and at the expense of other considerations. And yes, that wee piece of software that is the secure gateway of choice and has been for a great length of time; among a great many other innovations mentioned in the link in another reply.

freedomtaco 10y ago

Theo's right of course. Paradoxically, projects on github flourish because contributors and users by in large ignore the licenses. Granted, licenses are extremely important to protect intellectual property but nothing kills contributions to open source more than bureaucracy.

tingol 10y ago
What makes you think of all the things ignoring the licenses (citation needed) is the one that made github flourish?
- freedomtaco 10y ago
  I won't bother contributing to a project if I have to jump through hoops. The Github ecosystem removes these hoops. The license is a secondary concern for in-house software.
  - tingol 10y ago
    I still don't see what you mean by this. All of the top projects on github have pretty clear licenses which are automatically accepted by you (the contributor). In fact if you choose not to specify a license your work counts as copyrighted (as per github licensing documentation). So Github doesn't really remove any "hoops".

deleted 10y ago

[deleted]

robert_tweed 10y ago

Reproducing the text because the site is under too much load and Coral Cache can't resolve it: List: openbsd-misc Subject: Re: LLVM license change From: "Theo de Raadt" <deraadt () openbsd ! org> Date: 2016-09-28 4:27:44 Message-ID: 91077.1475036864 () cvs ! openbsd ! org [Download message RAW] > And that is because corporate "contributor-wannabes" put pressure on the > LLVM foundation. > http://lists.llvm.org/pipermail/llvm-dev/2015-October/091536.html > > It does say "this is an RFC" but that was last year. We are now in this > year: > http://lists.llvm.org/pipermail/llvm-dev/2016-September/104778.html > > What I particularly do not like is the "IANAL but let's do it anyway" > drift emanating from a lot of high profile developers there. Well, I hope they do it. And then -- I hope a year or two later, some author of a component (especially one from Europe where the moral rights of an author still carries substantial weight) submarines the new licence, surfacing to indicate that they never signed off on the additional terms applied to them as a significant author, and will accept no cash to solve the problem. Then they are dead in the water. A cataclysm like CSRG went through. Then a fork of code on the original license can flourish. A fork based upon the last free version -- but let's remember that is the history of another piece of important software... So this problem could be fixed, if enough people care. In this situation, I suspect a few people are being paid a lot of wages to act as agents permitting theft from their co-contributors. They worked with others but now they are ready to steal from them. A list of all contributers (and every single one of them must agree) has not been published, so it is really likely this is a well-financed effort being performed by paralegals. Meanwhile day by day that list of contributors operating under the existing model is growing.. Someone is hoping they can get away with copyright theft. Want to have fun? Submit a major diff, which (seperately) in the submission says you'll never agree. Eventually most large projects find their inner Xfree86, I'm afraid to say.

shadowmint 10y ago
It's hard to have any idea what that means without the preceding context: > > > What does the OpenBSD community think about the LLVM proposal to move > > > to the Apache license? > > > > > > http://lists.llvm.org/pipermail/llvm-dev/2016-September/104778.html > > > > If LLVM would move to the Apache 2 license, we would become unable > > to use versions released after that change, and would be stuck with > > version released before the change, just like we are stuck with > > pre-GPLv3 gcc now. So it would be very bad for us. > > > > See http://www.openbsd.org/policy.html : > > > > Apache > > The original Apache license was similar to the Berkeley license, > > but source code published under version 2 of the Apache license > > is subject to additional restrictions and cannot be included > > into OpenBSD. > > > > In a nutshell, OpenBSD does not consider software released under > > Apache 2 to be free software. At least not free enough for us

StreamBright 10y ago

Could somebody tl;dr me what is going on with LLVM and why the new licensing would be bad according to Theo?

lambda 10y ago
LLVM wants to switch from a BSD-style license to Apache 2.0, with a few exceptions, one allowing use with GPLv2 code, another allowing the bits of compiler-rt and other components that get built into binaries to be redistributed without restriction. The main benefit of Apache 2.0 is that it includes a patent grant as well. Right now, LLVM relies on a custom "developer agreement" for anyone who contributes code that includes a grant of patent rights, but it's kind of vague and fuzzy and so makes it hard for some people to contribute, and the license itself doesn't actually mention patents at all: http://lists.llvm.org/pipermail/llvm-dev/2015-October/091536.html http://lists.llvm.org/pipermail/llvm-dev/2015-October/091536... Theo objects to any license that applies more restrictions than the original BSD license. OpenBSD makes an exception for GPLv2 licensed utilities that have been traditionally shipped with BSDs that there's not a good replacement for, but has stopped upgrading things that have moved to GPLv3 and apparently objects to the Apache license as well.
- StreamBright 10y ago
  Thank you very much for the detailed description. Makes sense now.
- saurik 10y ago
  The existing patent agreements seem to make the current license not comparable BSD but instead comparable to an awkward or even apparently extreme Apache 2.0, so isn't this about in practice removing restrictions, not adding restrictions? (This thought process is backed up by their stated reasoning and the kinds of contributors that are supposedly complaining.)
  - drewcrawford 10y ago
    "Additional restrictions" can be funny. You may recall the FSF's position that the app store EULA placed "additional restrictions" on the GPL, a position that was and remains controversial. In this case, it is a little harder to understand OpenBSD's interpretation of additional restrictions because they haven't listed their objections in any centralized place, but from reading around, they seem to believe: * "You must cause any modified files to carry prominent notices stating that You changed the files" is an additional restriction * "any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License" is an additional restriction * The sheer length and complexity of the Apache license suggests to them there are other additional restrictions buried in there somewhere

kod 10y ago

Theo deRaadt complaining about "copyright theft" is hilarious given his original stance on the ipfilter debacle.

TheRealPomax 10y ago
then again, we don't pat people on the back for holding on to their odd views, we congratulate them for coming to new realizations and acting on those. So... no, not really. It's not even hypocritical. It's just someone who is currently raising a perfectly valid argument, and his arguments in previous debates have literally nothing to do with the current, legally constrained, discussion around events that appear to have been put in place and moved forward without buying from all parties involved.
mrweasel 10y ago
I might very well be wrong, but I believed that the licensing of the IPFilter code, and the clarification of the attached license was part of the reason that OpenBSD, and Theo, is so much against complex licenses. While better than the GPL, version 2 and 3, in the sense that it's shorter, the Apache 2 license is still much more complex than the ISC or the BSD/MIT licenses. Another part of the issue, for some developers at least, is that the Apache 2 license sort of acknowledges that software patents are a thing. So if you disagree that companies should be allowed to patent software, mathematics and processes, you might not pick a license that validates the existence of those patents.
- icebraining 10y ago
  So if you disagree that companies should be allowed to patent software, mathematics and processes, you might not pick a license that validates the existence of those patents. This sounds absurd to me. Software patents don't go away because one stops believing in them. Either the courts enforce them or not.
  - fungos 10y ago
    Sure, but I see the idea as a kind of boycott/protest. I disagree with patents, mainly software patents, consequently I will never use a license that consider patents.

Analemma_ 10y ago

Loaded language and feverish paranoia from Theo de Raadt? I'm shocked, shocked.

psibi 10y ago
As someone who doesn't follow the BSD development nor the LLVM, I don't know whether to take this as a sarcastic comment or a serious one.
- sneak 10y ago
  Theo is known to like to showboat.
zeeboo 10y ago
Funny because Theo didn't say either of the quotes your parent was talking about.
sctb 10y ago
We detached this subthread from https://news.ycombinator.com/item?id=12618071 https://news.ycombinator.com/item?id=12618071 and marked it off-topic.

maxlybbert 10y ago

It's common for open source projects to change licenses. To be honest, I'm pretty sure that most projects have set the bar much higher than it legally is. In other words, I think de Raadt's fantasy isn't going to happen, and if it did, the fallout would likely be that many projects would lose the ability to enforce their licenses. Usually, when a project changes its license, it either tries to get permission from each contributor; or it makes an announcement that if any contributor objects, they will remove that person's contributions on request. But US law doesn't actually require that. In the US ( http://copyright.universityofcalifornia.edu/ownership/joint-works.html http://copyright.universityofcalifornia.edu/ownership/joint-... ): "Each joint author has the right to exercise any or all of the exclusive rights inherent in the joint work. Each author may: "• Grant third parties permission to use the work on a nonexclusive basis without the consent of other joint authors "• Transfer his or her entire ownership interest to another person without the other joint authors' consent". In other words, unless you have some kind of enforceable agreement between all contributors, any contributor can relicense the work, without the consent of the other contributors. I'm not sure whether the GPL qualifies as the kind of agreement that could prevent this; the FSF has spent years saying the GPL doesn't meet all the standard requirements of a contract because it doesn't need to be a contract. The FSF famously requires contributors to transfer their copyright interest to the FSF because Stallman says an attorney told him that makes it easier to enforce the GPL. Or, as Eben Moglen says ( https://www.gnu.org/licenses/why-assign.en.html https://www.gnu.org/licenses/why-assign.en.html ): "If there are multiple authors of a copyrighted work, successful enforcement depends on having the cooperation of all authors. "... [I]n order to be able to enforce the GPL most effectively, FSF requires that each author of code incorporated in FSF projects provide a copyright assignment, and, where appropriate, a disclaimer of any work-for-hire ownership claims by the programmer's employer." Many open source licenses other than the GPL don't have any chance of qualifying as the kind of agreement that could prevent a single contributor from relicensing the project on a whim. Also note that "contributor" doesn't necessarily mean to "contributor to the parent project." I haven't been able to find any legal reason somebody can't fork a project (following the license), make enough changes to become a joint copyright owner as far as their fork is concerned, and then relicense the fork. I guess the original contributors would also be joint copyright holders as far as the fork is concerned, and could relicense the fork as well. I'm not sure where that would end; and I'm glad that so far nobody's been creative enough to start such a battle. So, back to LLVM: Apple is, without question, a joint copyright holder and can relicense the code as desired. De Raadt's idea is that a European could say "well, the relicensing was OK under US law, but not under European law." But I don't see how moral rights would prevent relicensing. The Berne Convention establishes moral rights as ( https://en.wikipedia.org/wiki/Moral_rights https://en.wikipedia.org/wiki/Moral_rights ): "Independent of the author's economic rights, and even after the transfer of the said rights, the author shall have the right to claim authorship of the work and to object to any distortion, modification of, or other derogatory action in relation to the said work, which would be prejudicial to the author's honor or reputation." Note, (1) that is "independent of an author's economic rights" and (2) the contributor has the ability to object to any modification, mutilation, distortion, etc., of the work; not of the terms the work is distributed under. Countries can establish their own idea of moral rights, but I'm pretty sure they will follow the Berne Convention's definition pretty closely. So I would predict the outcome would be a court opinion that any contributor has the right to change the license, and that moral rights aren't the right tool to stop a relicensing. And if anybody can fork, become a contributor in the fork, and relicense the fork, I don't see how anyone can enforce any license restrictions.

FiloSottile 10y ago

All the comments here seem to focus on Theo, the Apache license vs. the BSD one, and for some reason the OpenBSD policy. But my understanding of that email is about the irregularity of a unilateral change of license. The contributors own their work and licensed it under one license, and the project wants to change it without doing the Herculean job of getting permission from all. I think Theo is correct there saying that there is a risk that one of those contributors will then come out of the woods and wreak havoc, risking a forced fork from the relicense point. IANAL, but "you don't change the license" is one of the few things I was taught.

kr7 10y ago
License changes are not unheard of. Wine changed from the MIT license to LGPL without all of the developer's support.
- lukeschlather 10y ago
  That's fine within the terms of the MIT license. It's not okay to relicense LGPL to MIT without author consent.
  - the_mitsuhiko 10y ago
    You can't do that but you can do further contributions under the LGPL which essentially makes it an LGPL project.
    - jsmthrowaway 10y ago
      What provision of the MIT license prevents it? My understanding is that MIT -> GPL is legal as long as the required notice is kept for MIT compliance, since MIT is a subset of GPL.
      - protomyth 10y ago
        What provision of the MIT License allows it? By default it is prevented in a copyrighted work. I don't think the sublicense clause covers it.

Koshkin 10y ago

Everybody enjoys free (as in "freedom") software. Turns out, even quality-wise free software is often much better than non-free, closed-source software. On the other hand, it may be hard to really understand the rationale behind it. The idea goes against the principles of capitalism (based on property rights). Also, if it is completely OK for hardware design to be proprietary, why should it not be OK for software? What is so special about it? The arguments put forward by proponents of free software do not seem very convincing, and sometimes their personalities do not help attracting people to their cause. Often, this ideal becomes a nuisance even in the world of open source. If you want to use Debian, for instance, you are pretty much forced to use "non-free" repositories (or a "non-free" Debian re-distribution) for your setup to be useful.

gwright 10y ago
What principle of capitalism is being violated? If anything, the freedom to set a price, even $0 if you so choose, sounds like the free market at work.
- Koshkin 10y ago
  The issue has never been about price.
  - gwright 10y ago
    OK, then what principle of capitalism are you referring to?
    - Koshkin 10y ago
      Property rights. The "free software" principle proclaims that software (possibly, among other things) should be "freed" from the possibility of being anyone's private property. (This also somehow gets mixed with this odd idea that software should be considered a form of "free speech".)
      - 10y ago

sneak 10y ago

lol copyright.

sctb 10y ago
We've asked you not to comment unsubstantively like this, and we ban accounts that continue to do so. Please stop.
- sneak 10y ago
  Apologies; I will. Perhaps I assumed too much context. Through my use of significantly outdated slang I was hoping to communicate something along the lines of "almost the entirety of the internet functions simply because almost all people ignore the legal make-believe that is intellectual property", and my comment was an attempt at a tongue-in-cheek reminder of this. Regardless, I won't comment further. Message received.

Someone 10y ago

http://llvm.org/docs/DeveloperPolicy.html#copyright http://llvm.org/docs/DeveloperPolicy.html#copyright: "The LLVM project does not require copyright assignments, which means that the copyright for the code in the project is held by its respective contributors who have each agreed to release their contributed code under the terms of the LLVM License. An implication of this is that the LLVM license is unlikely to ever change: changing it would require tracking down all the contributors to LLVM and getting them to agree that a license change is acceptable for their contribution. Since there are no plans to change the license, this is not a cause for concern. As a contributor to the project, this means that you (or your company) retain ownership of the code you contribute, that it cannot be used in a way that contradicts the license (which is a liberal BSD-style license), and that the license for your contributions won’t change without your approval in the future." OOPS.

JoshTriplett 10y ago
The LLVM license (the UofI/NCSA license) is permissive, and thus compatible with just about everything, including the Apache 2.0 license. All the existing code can stay under the old license unless someone agrees to the new one. New contributions can go under the new license. The effective license of the codebase will become Apache 2.0, with some pieces still available under the previous permissive license.
- notaplumber 10y ago
  This is considered a dick move for a project to make, often this means any non-trivial changes to existing code will be under the more restrictive licence, with no backward compatibility, preventing such changes from being incorporated by the original authors or anyone perusing a fork of the originally permissive codebase. A common example of this kind of behaviour is GPL proponents forking BSD or other similiarly licensed software, and exclusively wrapping their contributions to it under the GPLv3.
  - JoshTriplett 10y ago
    A license change certainly shouldn't happen lightly, or without consulting the community. In this case, it looks like an extensively considered decision with substantial community feedback. And patent lawsuits hurt, so as reasons to change licenses go, that seems like a pretty good one.

DannyBee 10y ago

I'm not sure why anyone thinks there will not be a real license change process. There will. This is just the stage of settling the question of what the license should be. Everyone is quite aware of the work it will take to actually change the license (I've managed the process for a number of large projects before) and random commentary from Theo that it will just be unilaterally changed is simply wrong. Chris's email even says this " Once we reach an agreement on the path to take, we can start talking about logistics of how to get there." As for the corporate wannabes comment, the truth is that folks have gone out of their way to talk to both users and contributors, at the developer conference and elsewhere (and in fact, we've spent a year trying to come up with licensing solutions to ensure we don't cause problems for various one off users, whereas most projects who have relicensed usually just told them tough luck). Past that, I'll be honest:I'm pretty uninterested in what a bunch of random people on an unrelated mailing list, who don't participate in the community at all, want to think. Especially when they have pretty much no data and have never bothered to simply ask questions on the llvm mailing list in the thread (or at the developer conference, or...), like others did. If they have real concerns, they are welcome to raise them in any of the normal ways.

johncolanduoni 10y ago

I'm confused. The post he's responding to is just saying that they want to move to the Apache 2.0 license if possible. Chris certainly doesn't seem to be assuming they can just flick a switch and make it happen, considering he talks about "logistics" and is pretty clear it is still in the discussion stage. Is it a dick move just to ask the contributors if they're willing to provide the code under the Apache 2.0 license so people can use LLVM without worrying about being sued for patent infringement? This looks to me like Apple and other corporate contributors with large patent portfolios giving users without such bargaining chips some protections from litigation. I find it hard to see that as a bad thing, unless they were in fact deciding to pretend they own the copyright of the whole project and dare contributors to sue them. Thus far I see no evidence of that.

Keyframe 10y ago

Is dual license a possibility?

petertodd 10y ago
Not really. The anti-patent protections Apache provides don't work if the patent holder has the option to use the license without those protections instead. I believe this is why it's common for projects to dual-license under Apache and GPLv3 - both licenses have anti-patent provisions.
- eridius 10y ago
  But it's not the patent holder that uses the license at all. It's the downstream user. Any downstream user would be protected by the patent clause as long as they're using the Apache 2.0 license regardless of what the patent holder wishes.
  - petertodd 10y ago
    Hmm. That's a good point; I've probably misunderstood that. Thanks! I'll do some more research.

notaplumber 10y ago

OpenBSD's been around for a long time, it would be unwise to dismiss these concerns, especially considering they've demonstrated this has happened before. LLVM/clang was recently imported into OpenBSD and is being brought into shape to potentially replace GCC, having OpenBSD developers eyes on a codebase has also historically been a good thing.. I think a future without their input will be bleak.

libman 10y ago

I got -15 karma on this site for saying the same thing.