5 ms·

Please consider using a license other than MIT. MIT assumes all contributors work for a single institution, and doesn't protect licensees from later patent infr

Please consider using a license other than MIT. MIT assumes all contributors work for a single institution, and doesn't protect licensees from later patent infringement claims. https://writing.kemitchell.com/2019/03/09/Deprecation-Notice.html https://writing.kemitchell.com/2019/03/09/Deprecation-Notice... Either Apache 2.0 or Blue Oak Model would be better choices.

azhenley 8y ago
I don’t know much about licenses but last week I added a license to one of my GitHub repositories for the first time. GitHub seemed to be heavily pushing MIT as the default. If the MIT license assumes everyone works at the same place then that seems horrible for GitHub repositories, right?
- teddyh 8y ago
  Horrible for who? Who would it be horrible for, who would it benefit, and who is in a position to decide what the default is? Cui bono?
  - velcrovan 8y ago
    Horrible in the sense of being an obvious mismatch for how development happens on GitHub, which pretty much exists to make contributions easy across institutional boundaries. No one benefits from the choice of MIT as a GitHub default. It's a quagmire of legal confusion borne out of pure ignorance.
    - teddyh 8y ago
      > GitHub, which pretty much exists to make contributions easy across institutional boundaries No, GitHub exists to somehow benefit the current owners, Microsoft, however they decide is the best way. > No one benefits from the choice of MIT as a GitHub default. Actually, there is a good argument to be made that Microsoft actually benefits from MIT being the default, as nickpsecurity pointed out in a sibling comment.
      - velcrovan 8y ago
        OK I see what you're getting at. Sure, maybe MS is pushing MIT out of sneaky bastardliness. But, it kinda sounds like what you're saying is that as long as it's good for the owner it can't also be horrible. I mean, my auto shop exists to benefit me however I decide is best, and there is a good argument to be made that I benefit from sabotaging my customers' cars. So what!
        teddyh 8y ago
        > But, it kinda sounds like what you're saying is that as long as it's good for the owner it can't also be horrible. Oh, that explains the downvotes. No, that’s not what I meant. What I was trying to do was to socratically tease out the strangeness of calling something “horrible for GitHub repositories”, as if GitHub repositories had an inherent purpose.
foldr 8y ago
>MIT assumes all contributors work for a single institution Could you expand on this? I can't see this assumption anywhere in the MIT license, and the link you provide doesn't clarify on this point. I also find the Blue Oak license much more difficult to understand than the MIT license, FWIW.
- hobofan 8y ago
  I have never heard that either but I guess that impression might come from the first line of the MIT license: > Copyright (c) <year> <copyright holders> Where <copyright holders> is often filled as the company of the primary developer, e.g. "Facebook". What I often see (and use) to avoid this, is filling it in with "The <project> developers", e.g. "The React developers".
  - kemitchell 8y ago
    In the blog post linked above, I make the point that > Copyright the Project developers conveys zero information. Of course contributors to a software project hold copyright in it. Who else should? But who are those contributors? The Blue Oak Model embraces the practical reality: When we want to know contributed to an open software project, we look to development files and revision-control data, not the license.
  - foldr 8y ago
    Ah I see, good point. I think management of code copyright is inherently complicated and not something that a license template can really fix. You do need to keep track of who has copyright of the code.
    - velcrovan 8y ago
      The link I provided does explain this, under the section “MIT and BSD don’t expect more contributors”, which reads in part: “MIT and BSD terms include a space for a single copyright notice, because they were written for releases from academic institutions that own all the copyrights in their employees’ work. What about other contributors to the project? They hold copyright in their contributions.” Apache 2.0 DOES address this issue in a complicated way, through the supplementary use of Contributor License Agreements. Other non-Apache projects like Fossil also require you to physically sign a CLA before contributing code to the project. Blue Oak handles this in a more straightforward way, by explicitly saying that, as a condition of the license, every contributor in turn allows any use of their code that would otherwise infringe their copyright or patent claims. Who is a contributor? Anyone who contributes code. No CLA needed.
nickpsecurity 8y ago
I'll add to your comment that Microsoft is a known, patent troll. They can give a business something free under MIT, wait until it makes a fortune, and then sue them for same code in patent courts. License like Apache 2.0 give a copyright and patent license for the code. Makes such scenarios impossible. Whether they'll actually do it or not is an unknown. I'd prefer we default on licenses that nullify the patent risk.
- deleted 8y ago
  [deleted]

azhenley 8y ago

I don’t know much about licenses but last week I added a license to one of my GitHub repositories for the first time. GitHub seemed to be heavily pushing MIT as the default. If the MIT license assumes everyone works at the same place then that seems horrible for GitHub repositories, right?

teddyh 8y ago
Horrible for who? Who would it be horrible for, who would it benefit, and who is in a position to decide what the default is? Cui bono?
- velcrovan 8y ago
  Horrible in the sense of being an obvious mismatch for how development happens on GitHub, which pretty much exists to make contributions easy across institutional boundaries. No one benefits from the choice of MIT as a GitHub default. It's a quagmire of legal confusion borne out of pure ignorance.
  - teddyh 8y ago
    > GitHub, which pretty much exists to make contributions easy across institutional boundaries No, GitHub exists to somehow benefit the current owners, Microsoft, however they decide is the best way. > No one benefits from the choice of MIT as a GitHub default. Actually, there is a good argument to be made that Microsoft actually benefits from MIT being the default, as nickpsecurity pointed out in a sibling comment.
    - velcrovan 8y ago
      OK I see what you're getting at. Sure, maybe MS is pushing MIT out of sneaky bastardliness. But, it kinda sounds like what you're saying is that as long as it's good for the owner it can't also be horrible. I mean, my auto shop exists to benefit me however I decide is best, and there is a good argument to be made that I benefit from sabotaging my customers' cars. So what!
      - teddyh 8y ago
        > But, it kinda sounds like what you're saying is that as long as it's good for the owner it can't also be horrible. Oh, that explains the downvotes. No, that’s not what I meant. What I was trying to do was to socratically tease out the strangeness of calling something “horrible for GitHub repositories”, as if GitHub repositories had an inherent purpose.

foldr 8y ago

>MIT assumes all contributors work for a single institution Could you expand on this? I can't see this assumption anywhere in the MIT license, and the link you provide doesn't clarify on this point. I also find the Blue Oak license much more difficult to understand than the MIT license, FWIW.

hobofan 8y ago
I have never heard that either but I guess that impression might come from the first line of the MIT license: > Copyright (c) <year> <copyright holders> Where <copyright holders> is often filled as the company of the primary developer, e.g. "Facebook". What I often see (and use) to avoid this, is filling it in with "The <project> developers", e.g. "The React developers".
- kemitchell 8y ago
  In the blog post linked above, I make the point that > Copyright the Project developers conveys zero information. Of course contributors to a software project hold copyright in it. Who else should? But who are those contributors? The Blue Oak Model embraces the practical reality: When we want to know contributed to an open software project, we look to development files and revision-control data, not the license.
- foldr 8y ago
  Ah I see, good point. I think management of code copyright is inherently complicated and not something that a license template can really fix. You do need to keep track of who has copyright of the code.
  - velcrovan 8y ago
    The link I provided does explain this, under the section “MIT and BSD don’t expect more contributors”, which reads in part: “MIT and BSD terms include a space for a single copyright notice, because they were written for releases from academic institutions that own all the copyrights in their employees’ work. What about other contributors to the project? They hold copyright in their contributions.” Apache 2.0 DOES address this issue in a complicated way, through the supplementary use of Contributor License Agreements. Other non-Apache projects like Fossil also require you to physically sign a CLA before contributing code to the project. Blue Oak handles this in a more straightforward way, by explicitly saying that, as a condition of the license, every contributor in turn allows any use of their code that would otherwise infringe their copyright or patent claims. Who is a contributor? Anyone who contributes code. No CLA needed.

nickpsecurity 8y ago

I'll add to your comment that Microsoft is a known, patent troll. They can give a business something free under MIT, wait until it makes a fortune, and then sue them for same code in patent courts. License like Apache 2.0 give a copyright and patent license for the code. Makes such scenarios impossible. Whether they'll actually do it or not is an unknown. I'd prefer we default on licenses that nullify the patent risk.

deleted 8y ago
[deleted]