9 ms·

Mark Kettenis' formal objection on behalf of the OpenBSD project: http://lists.llvm.org/pipermail/llvm-dev/2017-April/112300.html http://lists.llvm.org/pipermai

Mark Kettenis' formal objection on behalf of the OpenBSD project: http://lists.llvm.org/pipermail/llvm-dev/2017-April/112300.html http://lists.llvm.org/pipermail/llvm-dev/2017-April/112300.h... Theo de Raadt: https://news.ycombinator.com/item?id=12617881 https://news.ycombinator.com/item?id=12617881 These objections have been largely glossed over by the LLVM community. It's no secret that a handful of corporations are pushing for this change, and not the best interest of the open source community. Especially the larger ones using LLVM, like *BSD. LLVM is already under a permissive BSD-like license (NCSA), as pointed out by jwilk: https://news.ycombinator.com/item?id=18700258 https://news.ycombinator.com/item?id=18700258 OpenSSL is similarly attempting the same thing with newer versions of OpenSSL, which they went about in a particularly legally dubious way: https://lwn.net/Articles/717996/ https://lwn.net/Articles/717996/ (For context, OpenBSD maintains LibreSSL).

amyjess 8y ago
Honestly, if a project is so blinded by zealotry that even a non-copyleft license like Apache 2.0 isn't free enough, then I don't see any reason to engage with them in any form.
- notaplumber 8y ago
  This isn't a new policy. It's largely the same reason OpenBSD shipped with a fork of Apache 1.3.x for many years before ultimately writing their own httpd(8). The Apache 2.0 intertwines US Contract law with Copyright law, and that is considered wholly "not permissive enough". "In addition, the clause about the patent license is problematic because a patent license cannot be granted under Copyright law, but only under contract law, which drags the whole license into the domain of contract law. But while Copyright law is somewhat standardized by international agreements, contract law differs wildly among jurisdictions. So what the license means in different jurisdictions may vary and is hard to predict." https://www.openbsd.org/policy.html https://www.openbsd.org/policy.html
  - amyjess 8y ago
    > This isn't a new policy. It's largely the same reason OpenBSD shipped with a fork of Apache 1.3.x for many years before ultimately writing their own httpd(8). From what I recall, Apache httpd 2.0 came out a long time before Apache License 2.0. A quick check of Wikipedia confirms it: > The Apache HTTP Server codebase was relicensed to the Apache 2.0 License (from the previous 1.1 license) in January 2004, and Apache HTTP Server 1.3.31 and 2.0.49 were the first releases using the new license. If OpenBSD wanted to use httpd 2.x without switching to the new license, they could have forked 2.0.48. Their reasons for not using httpd 2.x were entirely technical. Architecturally, 2.x was a major departure from 1.x, and the OpenBSD developers were grognards who rejected it because they weren't interested in a web server that deviates from tradition. And since Apache still maintained 1.3.x for ages after 2.0 came out, it made their decision easier (well, until the license change hit). And this is a huge digression anyway: I honestly don't see a reason to cater to a group of people who would cut off their nose to spite their face. The LLVM team has better things to do with their time.
    - notaplumber 8y ago
      You're correct that were architectural reasons initially for why Apache httpd 2.0 not considered, but the license also played a significant role in later years, when it became obvious that Apache 1.3.x was showing its age. nginx was initially considered, but the upstream wasn't receptive to patches that OpenBSD worked on, including a chroot(2) support and security patches, i.e: reallocarray to protect against arithmetic overflows. At the time, Nginx cared more about it's Nginx PLUS offering and less about the community.
    - apotheon 8y ago
      > the OpenBSD developers were grognards who rejected it because they weren't interested in a web server that deviates from tradition That doesn't seem like a fair description of what happened. I think it was more that the OpenBSD project didn't want Apache 2.x in the base system, and thought that if people wanted it they could get it from the package manager. There might also have been some licensing issues in the sense that they'd prefer no Apache license at all, but that was apparently secondary to the changes in Apache code that contributed to the decision.
- apotheon 8y ago
  Licenses that have legal compatibility problems with other licenses are problematic. In fact, that's one of the reasons copyleft licenses are problematic: legal incompatibility with many other licenses. In that respect, AL2 is as problematic as some copyleft licenses. It also comes with some weird bookkeeping issues, like having to mark changed files in ambiguous circumstances, and requirements for how a file with a particular name (NOTICE) must legally be treated. These kinds of things can add to the burdens involved in building derived works, maintaining modified forks, or borrowing code.
DannyBee 8y ago
" It's no secret that a handful of corporations are pushing for this change" This is not actually true, and needs citation/data. This is actually the foundation trying to keep peace, and in a good way. "and not the best interest of the open source community" And this is an unsourced assumption of bad faith. It's also demonstrably false.
- notaplumber 8y ago
  http://lists.llvm.org/pipermail/llvm-dev/2015-October/091536.html http://lists.llvm.org/pipermail/llvm-dev/2015-October/091536... It's stated as much in the initial proposal. "1) Some contributors are actively blocked from contributing code to LLVM." > These contributors have been holding back patches for quite some time that they’d like to upstream. Corporate contributors (in particular) often have patents on many different things, and while it is reasonable for them to grant access to patents related to LLVM, the wording in the Developer Policy can be interpreted to imply that unrelated parts of their IP could accidentally be granted to LLVM (through “scope creep”).
  - DannyBee 8y ago
    This is not even remotely the same as "a handful of corporations" or "not in the best interest of the open source community". Also, you elided the other 2 large reasons given, which don't support your point at all. For example, GCC has an exception for its runtime libraries that it now applies universally for the exact same reasons - desire to share code, etc. It has that problem even reusing code from other GNU projects as well!
    - notaplumber 8y ago
      > This is a complicated topic that deals with legal issues and our primary goal is to unblock contributions from specific corporate contributors. You were saying?
      - chandlerc1024 8y ago
wyldfire 8y ago
de Raadt's scenario about submitting no-signoff content has already happened: de Espindola doesn't agree [1]. Though this was probably predictable given his objections raised before his departure. Presumably the foundation has a plan for resolving this problem. [1] http://lists.llvm.org/pipermail/llvm-dev/2018-December/128606.html http://lists.llvm.org/pipermail/llvm-dev/2018-December/12860...
- DannyBee 8y ago
  FWIW: The vast majority of his contributions are certainly not owned by him. (He worked for Google for a while while working on LLVM, etc).

amyjess 8y ago

Honestly, if a project is so blinded by zealotry that even a non-copyleft license like Apache 2.0 isn't free enough, then I don't see any reason to engage with them in any form.

notaplumber 8y ago
This isn't a new policy. It's largely the same reason OpenBSD shipped with a fork of Apache 1.3.x for many years before ultimately writing their own httpd(8). The Apache 2.0 intertwines US Contract law with Copyright law, and that is considered wholly "not permissive enough". "In addition, the clause about the patent license is problematic because a patent license cannot be granted under Copyright law, but only under contract law, which drags the whole license into the domain of contract law. But while Copyright law is somewhat standardized by international agreements, contract law differs wildly among jurisdictions. So what the license means in different jurisdictions may vary and is hard to predict." https://www.openbsd.org/policy.html https://www.openbsd.org/policy.html
- amyjess 8y ago
  > This isn't a new policy. It's largely the same reason OpenBSD shipped with a fork of Apache 1.3.x for many years before ultimately writing their own httpd(8). From what I recall, Apache httpd 2.0 came out a long time before Apache License 2.0. A quick check of Wikipedia confirms it: > The Apache HTTP Server codebase was relicensed to the Apache 2.0 License (from the previous 1.1 license) in January 2004, and Apache HTTP Server 1.3.31 and 2.0.49 were the first releases using the new license. If OpenBSD wanted to use httpd 2.x without switching to the new license, they could have forked 2.0.48. Their reasons for not using httpd 2.x were entirely technical. Architecturally, 2.x was a major departure from 1.x, and the OpenBSD developers were grognards who rejected it because they weren't interested in a web server that deviates from tradition. And since Apache still maintained 1.3.x for ages after 2.0 came out, it made their decision easier (well, until the license change hit). And this is a huge digression anyway: I honestly don't see a reason to cater to a group of people who would cut off their nose to spite their face. The LLVM team has better things to do with their time.
  - notaplumber 8y ago
    You're correct that were architectural reasons initially for why Apache httpd 2.0 not considered, but the license also played a significant role in later years, when it became obvious that Apache 1.3.x was showing its age. nginx was initially considered, but the upstream wasn't receptive to patches that OpenBSD worked on, including a chroot(2) support and security patches, i.e: reallocarray to protect against arithmetic overflows. At the time, Nginx cared more about it's Nginx PLUS offering and less about the community.
  - apotheon 8y ago
    > the OpenBSD developers were grognards who rejected it because they weren't interested in a web server that deviates from tradition That doesn't seem like a fair description of what happened. I think it was more that the OpenBSD project didn't want Apache 2.x in the base system, and thought that if people wanted it they could get it from the package manager. There might also have been some licensing issues in the sense that they'd prefer no Apache license at all, but that was apparently secondary to the changes in Apache code that contributed to the decision.
apotheon 8y ago
Licenses that have legal compatibility problems with other licenses are problematic. In fact, that's one of the reasons copyleft licenses are problematic: legal incompatibility with many other licenses. In that respect, AL2 is as problematic as some copyleft licenses. It also comes with some weird bookkeeping issues, like having to mark changed files in ambiguous circumstances, and requirements for how a file with a particular name (NOTICE) must legally be treated. These kinds of things can add to the burdens involved in building derived works, maintaining modified forks, or borrowing code.

DannyBee 8y ago

" It's no secret that a handful of corporations are pushing for this change" This is not actually true, and needs citation/data. This is actually the foundation trying to keep peace, and in a good way. "and not the best interest of the open source community" And this is an unsourced assumption of bad faith. It's also demonstrably false.

notaplumber 8y ago
http://lists.llvm.org/pipermail/llvm-dev/2015-October/091536.html http://lists.llvm.org/pipermail/llvm-dev/2015-October/091536... It's stated as much in the initial proposal. "1) Some contributors are actively blocked from contributing code to LLVM." > These contributors have been holding back patches for quite some time that they’d like to upstream. Corporate contributors (in particular) often have patents on many different things, and while it is reasonable for them to grant access to patents related to LLVM, the wording in the Developer Policy can be interpreted to imply that unrelated parts of their IP could accidentally be granted to LLVM (through “scope creep”).
- DannyBee 8y ago
  This is not even remotely the same as "a handful of corporations" or "not in the best interest of the open source community". Also, you elided the other 2 large reasons given, which don't support your point at all. For example, GCC has an exception for its runtime libraries that it now applies universally for the exact same reasons - desire to share code, etc. It has that problem even reusing code from other GNU projects as well!
  - notaplumber 8y ago
    > This is a complicated topic that deals with legal issues and our primary goal is to unblock contributions from specific corporate contributors. You were saying?
    - chandlerc1024 8y ago

wyldfire 8y ago

de Raadt's scenario about submitting no-signoff content has already happened: de Espindola doesn't agree [1]. Though this was probably predictable given his objections raised before his departure. Presumably the foundation has a plan for resolving this problem. [1] http://lists.llvm.org/pipermail/llvm-dev/2018-December/128606.html http://lists.llvm.org/pipermail/llvm-dev/2018-December/12860...

DannyBee 8y ago
FWIW: The vast majority of his contributions are certainly not owned by him. (He worked for Google for a while while working on LLVM, etc).