4 ms·

> Contributing to apache 2 software potentially grants universal licenses for relevant patents ... Not potentially. > (What if I start with apache 2 code, mak

> Contributing to apache 2 software potentially grants universal licenses for relevant patents ... Not potentially. > (What if I start with apache 2 code, make substantial changes, and apply it in areas the patent holder objects to, for example?) The plain reading of the license is that it only grants licenses to patents which are necessarily infringed by the contributions of the patent holder. As for what would happen if you heavily modify it, I suppose the court would have to decide whether it is still the same work. But that's strictly more protection than you have under BSD, so I don't really see why you would view it as a negative.

hedora 10y ago
If I'm the developer, I accidentally lose my patent, or (accidentally) misrepresent my employers intention not to license the patent, so I get hauled into court. If I am the user, and use Apache 2 software Yahoo (for example) contributed to before they sold their relevant patent to a troll, I'm fine. If that software is "Apache 2" OpenSSL, I'm totally screwed, even though the OpenSSL team's license.txt told me it's all OK while I was paying my lawyer to do due patent diligence.
- deleted 10y ago
  [deleted]
- obstinate 10y ago
  I don't think that your Yahoo scenario is correct. The license you are granted is perpetual and irrevocable. Yahoo transferring the patent to another party is one of an entire universe of things that cannot revoke your license to use it. It doesn't matter whether the other party decides they'd prefer you not use it -- you still own that license. I also don't have any sympathy for you if you contribute OSS code that necessarily infringes on a patent, but also want to retain your ability to enforce the patent against users of the OSS project you're contributing too. That use-case is one that has negative priority for me -- I would prefer that you be unable to contribute under those circumstances.
  - hedora 10y ago
    My argument isn't about apache 2 vs bsd. It is about the terrible legal issues relicensing other people's code without explict permission will create. The timeframes created by relicensing create particularly nasty problems. Here is an ordering of events where the developer and user act in good faith, but the troll wins: First, a dev at Yahoo contributes under the OpenSSL license. Years later, Yahoo sells to trolls (this is bad, but no one involved in OpenSSL did it). Even later, openssl decides to relicense as apache 2.0. Maybe the dev clicks yes on the relicense form (big mistake, since the patent is not held by the dev or yahoo anymore), maybe the dev clicks no, or maybe they don't reply. Let's go with "no reply" or "clicks yes". In those cases, openssl will not rewrite the code, and users will see that yahoo contributed to (now) apache 2 licensed OpenSSL and assume the patent protection apache 2 implies actually exists. Some decide to use the code, instead of some other actually unencumbered alternative. Later, the users get sued by the troll for violating the yahoo patent by running "apache 2" software yahoo wrote while yahoo held the patent. (When the troll bought the patent rights, the code was still openssl licensed, so the apache 2 relicensing definitely does not apply) Even without the patent sale, openssl will be misrepresenting grants of patent licenses unless they rewrite all the "no" and "no response" code, including all the derivatives of code. The repo is at least two decades old, so a "no" response from the early days is probably impossible to recover from. Anyway, the letter says they will treat "no response" as "yes", which clearly not going to hold up in court in most legal jurisdictions. Claiming apache 2 licensing at the end of this flawed process is simultaneously false advertising and hostile to users. It also hurts non-apache 2 downstream projects, or anyone paying enough attention to run away screaming. Contrast this to what would happen if they simply removed the advertising clauses, making it GPL compatible: They'd need permission from many fewer people, wouldn't break downstream, and wouldn't make false statements about patent licensing.

hedora 10y ago

If I'm the developer, I accidentally lose my patent, or (accidentally) misrepresent my employers intention not to license the patent, so I get hauled into court. If I am the user, and use Apache 2 software Yahoo (for example) contributed to before they sold their relevant patent to a troll, I'm fine. If that software is "Apache 2" OpenSSL, I'm totally screwed, even though the OpenSSL team's license.txt told me it's all OK while I was paying my lawyer to do due patent diligence.

deleted 10y ago
[deleted]
obstinate 10y ago
I don't think that your Yahoo scenario is correct. The license you are granted is perpetual and irrevocable. Yahoo transferring the patent to another party is one of an entire universe of things that cannot revoke your license to use it. It doesn't matter whether the other party decides they'd prefer you not use it -- you still own that license. I also don't have any sympathy for you if you contribute OSS code that necessarily infringes on a patent, but also want to retain your ability to enforce the patent against users of the OSS project you're contributing too. That use-case is one that has negative priority for me -- I would prefer that you be unable to contribute under those circumstances.
- hedora 10y ago
  My argument isn't about apache 2 vs bsd. It is about the terrible legal issues relicensing other people's code without explict permission will create. The timeframes created by relicensing create particularly nasty problems. Here is an ordering of events where the developer and user act in good faith, but the troll wins: First, a dev at Yahoo contributes under the OpenSSL license. Years later, Yahoo sells to trolls (this is bad, but no one involved in OpenSSL did it). Even later, openssl decides to relicense as apache 2.0. Maybe the dev clicks yes on the relicense form (big mistake, since the patent is not held by the dev or yahoo anymore), maybe the dev clicks no, or maybe they don't reply. Let's go with "no reply" or "clicks yes". In those cases, openssl will not rewrite the code, and users will see that yahoo contributed to (now) apache 2 licensed OpenSSL and assume the patent protection apache 2 implies actually exists. Some decide to use the code, instead of some other actually unencumbered alternative. Later, the users get sued by the troll for violating the yahoo patent by running "apache 2" software yahoo wrote while yahoo held the patent. (When the troll bought the patent rights, the code was still openssl licensed, so the apache 2 relicensing definitely does not apply) Even without the patent sale, openssl will be misrepresenting grants of patent licenses unless they rewrite all the "no" and "no response" code, including all the derivatives of code. The repo is at least two decades old, so a "no" response from the early days is probably impossible to recover from. Anyway, the letter says they will treat "no response" as "yes", which clearly not going to hold up in court in most legal jurisdictions. Claiming apache 2 licensing at the end of this flawed process is simultaneously false advertising and hostile to users. It also hurts non-apache 2 downstream projects, or anyone paying enough attention to run away screaming. Contrast this to what would happen if they simply removed the advertising clauses, making it GPL compatible: They'd need permission from many fewer people, wouldn't break downstream, and wouldn't make false statements about patent licensing.