8 ms·

So while I previously had regarded the MIT license as the one to generally use for any project where one has decided not to go the copyleft route, this guy seem

So while I previously had regarded the MIT license as the one to generally use for any project where one has decided not to go the copyleft route, this guy seems to be saying it's fine but Apache 2.0, being a little clearer about some edge cases, is the best of all permissive licenses and the one that should ideally be used. The FSF https://www.gnu.org/licenses/license-recommendations.html https://www.gnu.org/licenses/license-recommendations.html seems to agree with that. Can we take that conclusion away and go with it henceforth? Are there any downsides to it at all?

kibwen 10y ago
The downside is that it's not compatible with projects that are strictly GPL 2.0. Rust is dual-licensed under both Apache 2 and MIT for this reason.
- teamhappy 10y ago
  Also FreeBSD and OpenBSD aren't too fond of merging Apache 2.0 licensed code.
pm215 10y ago
The Apache 2.0 license isn't compatible with the GPLv2 (according to the FSF's compatibility list), whereas MIT is -- that may or may not be important to you. Apache 2.0 is compatible with GPLv3, and thus also with GPLv2-or-later code (in the latter case the combined work will end up under gpl3, obviously).
- rwallace 10y ago
  Ah! That probably is important actually; aren't some big projects, including the Linux kernel, GPL2 and going to remain so?
  - rmc 10y ago
    Yes, the Linux kernel was always licenced as "GPL2" without the "or later" bit that the FSF advised for GPL code.
    - LoSboccacc 10y ago
      the "later" part doesn't sound a good advice. who control the leicity of a gpl version release? say I'm releasing a document that say it's gpl v4 and assign all ownership to me. or the FSF goes corrupt.
      - cyphar 10y ago
        There's been massive discussion about this in multiple places, in short "or later" fear-mongering is just FUD. 1. Nobody forces you to upgrade to the latest version, it's only an option that people can exercise if they have a copy of your code. 2. In GPLv2 the FSF is the only entity that can create new versions, while in GPLv3 there are provisions for the original author to create a proxy (allowing them to delay the application of a newer GPL). 3. If the FSF goes corrupt, it is unlikely the new GPL will apply because the GPL states that newer licenses will be "in a similar spirit to this license". Given how much documentation the FSF has on their philosophy, it would be very clear if a newer GPL version violates their stated philosophy. Also, finally, you can't have a license that "assigns all ownership". Copyright licenses and CLAs aren't the same thing -- and I doubt that you can retro-actively force people to give up their copyrights like that. You should always use or-later because if you don't then you're just asking for trouble when the next GPL version is released and you have to ask every contributor whether they want to relicense their contributions. If you make it or-later in the beginning then there's no issue. If you don't like a GPL version you can always add restrictions to the all-later clause.
        ramshorns 10y ago
        Well, it's essentially multi-licensing without knowing what all the licenses are. It gives some power to the FSF to choose what the next license for your work will look like. If you like what one license says but you don't know whether you'll like the next license the FSF releases, it makes sense to wait until you see it before deciding to use it, and that means not putting "or later". I think Linux is a good example of this. Maybe users would be better off with GPLv3, but the copyright holders decided not to relicense. It's not asking for trouble to avoid relicensing until you can see the new license.
cat199 10y ago
Basically the issue is software patents - Not a lawyer, but MIT/BSD ignore patents, (software patents IIRC didn't exist when these licenses were created) whereas Apache2 provides indemnity against any users from related patent suits by contributors. (Sort of 'copylefting' associated patents, in a limited sense) This isn't really an 'edge case' at scale - many large tech entities have patents. Again, not a lawyer, I'd suspect this is 'best' here for adoptors of software using this license at smaller firms because lawyers reading the license know they are clearly protected from patent litigation by other contributors - that doesn't necessarily imply it's best overall - e.g. large companies with a large patent portfolio which is largely unrelated might not wish to even theoretically weaken their ability to use patents, or this might be a block to software adaptation/contribution due to bureaucratic reasons (e.g. all licenses must be approved by legal, who won't consider anything that mucks with their patents, even if it's not an issue here). Further, there is potential for the patent indemnity clause to make litigation murky - for example, if a patent is covered by this license, but a user further expands the code in an 'infringing' capacity, or infringes elsewhere, the indemnity provided by the base code might protect them against litigation where it is actually warranted.. Probably some things on the flip side too - e.g. by accepting the indemnity clause, you might be recognizing the validity of the customers patent which could then be applied elsewhere against you, etc. And as best I know (again, not lawyer and not up on details here) there isn't much case law around these licenses to clarify the murkyness. Again, not a lawyer at all, but 'best' is dubious - I do have a preference for the BSD/MIT because they avoid this whole quagmire - although I'm somewhat anti-software patents for most cases, and licenses such as this also legitimize them, the biggest thing for me here is that this clause makes the 'free use' of the software itself much more dubious and less clear cut. It would be interesting to have some more fine-grained information about biases/perspectives/rationales in this survey to help quantify the summary data..
- pksadiq 10y ago
  > Further, there is potential for the patent indemnity clause to make litigation murky - for example, if a patent is covered by this license, but a user further expands the code in an 'infringing' capacity, or infringes elsewhere, the indemnity provided by the base code might protect them against litigation where it is actually warranted.. Yeah, this is an issue with Apache 2 License. Say, the user can take only the patented code (and modify to meet his/her needs) and keep the rest of the code to have any license (including proprietary), and the user is at the safe side. In the case the code is licensed under GNU [A]GPLv3, the whole (modified and linked) code requires to be in [A]GPLv3. So no non-free derivations possible. If the user didn't free the code, the original author (who owns the patent AND wrote the [A]GPLv3 code) can sue the user (because the user has violated GNU [A]GPL).
JdeBP 10y ago
Read these * https://news.ycombinator.com/item?id=13942104 https://news.ycombinator.com/item?id=13942104 * https://news.ycombinator.com/item?id=13945492 https://news.ycombinator.com/item?id=13945492 * https://news.ycombinator.com/item?id=13946588 https://news.ycombinator.com/item?id=13946588 and you will find that we cannot.

kibwen 10y ago

The downside is that it's not compatible with projects that are strictly GPL 2.0. Rust is dual-licensed under both Apache 2 and MIT for this reason.

teamhappy 10y ago
Also FreeBSD and OpenBSD aren't too fond of merging Apache 2.0 licensed code.

pm215 10y ago

The Apache 2.0 license isn't compatible with the GPLv2 (according to the FSF's compatibility list), whereas MIT is -- that may or may not be important to you. Apache 2.0 is compatible with GPLv3, and thus also with GPLv2-or-later code (in the latter case the combined work will end up under gpl3, obviously).

rwallace 10y ago
Ah! That probably is important actually; aren't some big projects, including the Linux kernel, GPL2 and going to remain so?
- rmc 10y ago
  Yes, the Linux kernel was always licenced as "GPL2" without the "or later" bit that the FSF advised for GPL code.
  - LoSboccacc 10y ago
    the "later" part doesn't sound a good advice. who control the leicity of a gpl version release? say I'm releasing a document that say it's gpl v4 and assign all ownership to me. or the FSF goes corrupt.
    - cyphar 10y ago
      There's been massive discussion about this in multiple places, in short "or later" fear-mongering is just FUD. 1. Nobody forces you to upgrade to the latest version, it's only an option that people can exercise if they have a copy of your code. 2. In GPLv2 the FSF is the only entity that can create new versions, while in GPLv3 there are provisions for the original author to create a proxy (allowing them to delay the application of a newer GPL). 3. If the FSF goes corrupt, it is unlikely the new GPL will apply because the GPL states that newer licenses will be "in a similar spirit to this license". Given how much documentation the FSF has on their philosophy, it would be very clear if a newer GPL version violates their stated philosophy. Also, finally, you can't have a license that "assigns all ownership". Copyright licenses and CLAs aren't the same thing -- and I doubt that you can retro-actively force people to give up their copyrights like that. You should always use or-later because if you don't then you're just asking for trouble when the next GPL version is released and you have to ask every contributor whether they want to relicense their contributions. If you make it or-later in the beginning then there's no issue. If you don't like a GPL version you can always add restrictions to the all-later clause.
      - ramshorns 10y ago
        Well, it's essentially multi-licensing without knowing what all the licenses are. It gives some power to the FSF to choose what the next license for your work will look like. If you like what one license says but you don't know whether you'll like the next license the FSF releases, it makes sense to wait until you see it before deciding to use it, and that means not putting "or later". I think Linux is a good example of this. Maybe users would be better off with GPLv3, but the copyright holders decided not to relicense. It's not asking for trouble to avoid relicensing until you can see the new license.

cat199 10y ago

Basically the issue is software patents - Not a lawyer, but MIT/BSD ignore patents, (software patents IIRC didn't exist when these licenses were created) whereas Apache2 provides indemnity against any users from related patent suits by contributors. (Sort of 'copylefting' associated patents, in a limited sense) This isn't really an 'edge case' at scale - many large tech entities have patents. Again, not a lawyer, I'd suspect this is 'best' here for adoptors of software using this license at smaller firms because lawyers reading the license know they are clearly protected from patent litigation by other contributors - that doesn't necessarily imply it's best overall - e.g. large companies with a large patent portfolio which is largely unrelated might not wish to even theoretically weaken their ability to use patents, or this might be a block to software adaptation/contribution due to bureaucratic reasons (e.g. all licenses must be approved by legal, who won't consider anything that mucks with their patents, even if it's not an issue here). Further, there is potential for the patent indemnity clause to make litigation murky - for example, if a patent is covered by this license, but a user further expands the code in an 'infringing' capacity, or infringes elsewhere, the indemnity provided by the base code might protect them against litigation where it is actually warranted.. Probably some things on the flip side too - e.g. by accepting the indemnity clause, you might be recognizing the validity of the customers patent which could then be applied elsewhere against you, etc. And as best I know (again, not lawyer and not up on details here) there isn't much case law around these licenses to clarify the murkyness. Again, not a lawyer at all, but 'best' is dubious - I do have a preference for the BSD/MIT because they avoid this whole quagmire - although I'm somewhat anti-software patents for most cases, and licenses such as this also legitimize them, the biggest thing for me here is that this clause makes the 'free use' of the software itself much more dubious and less clear cut. It would be interesting to have some more fine-grained information about biases/perspectives/rationales in this survey to help quantify the summary data..

pksadiq 10y ago
> Further, there is potential for the patent indemnity clause to make litigation murky - for example, if a patent is covered by this license, but a user further expands the code in an 'infringing' capacity, or infringes elsewhere, the indemnity provided by the base code might protect them against litigation where it is actually warranted.. Yeah, this is an issue with Apache 2 License. Say, the user can take only the patented code (and modify to meet his/her needs) and keep the rest of the code to have any license (including proprietary), and the user is at the safe side. In the case the code is licensed under GNU [A]GPLv3, the whole (modified and linked) code requires to be in [A]GPLv3. So no non-free derivations possible. If the user didn't free the code, the original author (who owns the patent AND wrote the [A]GPLv3 code) can sue the user (because the user has violated GNU [A]GPL).

JdeBP 10y ago

Read these * https://news.ycombinator.com/item?id=13942104 https://news.ycombinator.com/item?id=13942104 * https://news.ycombinator.com/item?id=13945492 https://news.ycombinator.com/item?id=13945492 * https://news.ycombinator.com/item?id=13946588 https://news.ycombinator.com/item?id=13946588 and you will find that we cannot.