9 ms·

Bruce Perens: Invasion of the Ethical Licenses (2019)

125 points by kick 7y ago

weinzierl 7y ago
The Debian Free Software Guidelines (DFSG) (and their "Social Contract" with the Free Software Community for that matter) [1] are very short documents, and I recommend anyone reading them. Created in 1997, and only slightly changed once in 2004, they are a staple of free and open source software. [1] https://www.debian.org/social_contract#guidelines https://www.debian.org/social_contract#guidelines
- est31 7y ago
  IIRC the OSI criteria were even modeled after the DFSG. OSI was basically a project to decide which license is open source outside of a Debian context.
  - kick 7y ago
    Perens wrote both, so yeah, though OSI was just to make free software more corporate-friendly.
saagarjha 7y ago
Plus I’ve heard that these make this difficult to use by “legitimate” entities too since they’re non-standard and hence require more legal scrutiny.
- fhars 7y ago
  Yes, the canonical example is the good old „I give permission for IBM to use JSLint for evil“: https://news.ycombinator.com/item?id=5138866 https://news.ycombinator.com/item?id=5138866
  - hoistbypetard 7y ago
    Which has since gone away but can be found here: http://web.archive.org/web/20110418031915/http://dev.hasenj.org/post/3272592502/ibm-and-its-minions http://web.archive.org/web/20110418031915/http://dev.hasenj....
Latty 7y ago
I doubt anyone using these kinds of licenses really thinks they are going to "work" from the point of view of significantly limiting that behaviour. They do, however, act as a way to advertise the issues—this article being an example of how using a license like that causes people to publicise and maybe think about your issues. The final suggestion in the article is working to enact better laws: starting and maintaining the conversation is the first step to doing that.
- rwmj 7y ago
  They also act to stop people using your software since it won't be packaged in Linux distros and any companies considering it will run a mile as soon as they run it past their lawyers.
  - catalogia 7y ago
    If you want average Joes to use your software freely but dislike corporations, then picking a license that makes lawyers run might be the way to go. Or just use WTFPL and count on the profanity to offend conservative business sorts.
    - jsjohnst 7y ago
      > then picking a license that makes lawyers run might be the way to go In most of corporate America, that would be GPL or AGPL licenses, from direct experience working with outside council at multiple employers defining licensing policies.
      - catalogia 7y ago
        Yes, AGPLv3 is a crowd favorite for flipping corporate users the bird.
      - tyingq 7y ago
        AGPL maybe, but GPL doesn't seem to be a barrier. Linux, Emacs, MySQL, gcc, git, OpenJDK, etc...are everywhere in corporate America. Perhaps for libraries you link to that aren't LGPL.
msla 7y ago
The only possible purpose of these licenses is to act as Super Codes of Conduct, CoCs which can "kick out" people who aren't in the project by making it too difficult for them to keep using the software when one of the contributors could pull the trigger on legal action. The action doesn't have to be successful to be expensive to fight, after all; it's the old troll tactic of making the danegeld less expensive than the battle would be. Poof. Now anyone you don't like can't even use the software, let alone fork it and go their own direction with it. Ballmer could hardly have done it better.
- upofadown 7y ago
  Nothing to do with the project, everything to do with the users.
- matheusmoreira 7y ago
  They can just ignore the license if they want/need the software that much. Seriously doubt random users are gonna get sued for violating terms.
  - msla 7y ago
    > They can just ignore the license if they want/need the software that much. Seriously doubt random users are gonna get sued for violating terms. By all means tap-dance in the minefield. You'll probably be fine. Arbitrary enforcement is the cornerstone of a good, solid chilling effect. Finally, as a point of policy, I'd rather people not get the idea that OSS licenses are ignorable. That's even more Ballmer-esque in its implications.
Proven 7y ago
> The idea behind this was that Freedom meant Freedom for everyone, not just Freedom for people we approved of. It's not freedom for everyone. It cannot be used by those who do not accept the license. If they do accept it, it limits their rights to use, modify and redistribute the software within limits spelled out in the license. "You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License" Most people here refuse to understand that "freedom" can't be given by a license. It can stay the same, or become restricted (when a license imposes a duty or obligation on the licensee). The ethical licenses are a nonsense. Even the name is awful (how is it ethical to attempt to restrict another person's freedom?) Thankfully no project that I know or care about uses one of those.
- zAy0LfpBZLC8mAC 7y ago
  > how is it ethical to attempt to restrict another person's freedom? By preventing greater harm to others that would result if you didn't. Seriously, that wasn't obvious?
  - jessaustin 7y ago
    I smell authoritarians...
- MaxBarraclough 7y ago
  > It cannot be used by those who do not accept the license. This is wrong. You don't have to accept the terms of the GPL if you use a program, only if you distribute and/or modify it. https://opensource.stackexchange.com/a/2867/ https://opensource.stackexchange.com/a/2867/ From the text of the GPLv3: You are not required to accept this License in order to receive or run a copy of the Program. The Affero GPL is unusual, but even there, you don't have to accept the licence merely to run a program. > If they do accept it, it limits their rights to use, modify and redistribute the software within limits spelled out in the license. Again, no, it doesn't restrict the right to use. > Most people here refuse to understand that "freedom" can't be given by a license. It can stay the same, or become restricted (when a license imposes a duty or obligation on the licensee). That's wrong. You don't have rights to use/study/distribute/modify/modify+distribute software unless the software is in the public domain, or if those rights are actively granted to you by a licence. If you happen to stumble across some source code, and it's still under copyright, and there's no licence, then you have no right to it. Same goes if you find an unfinished novel. This is why GitHub took steps to encourage people to add a clearly stated licence to their projects. If you want to make the case for permissive BSD-style licences being 'more free' than copyleft licences, then sure, that's a debate we could have, but freedom absolutely is given by licences. > how is it ethical to attempt to restrict another person's freedom? Banning kidnapping and slavery increases the total freedom in a country. Copyleft operates on a similar principle, prohibiting people from taking Free software and using it as the basis for non-Free software. The copyleft-vs-permissive-licence debate I mentioned above, is as old as Free Software. Here's an old Slashdot thread where the usual points are made: https://developers.slashdot.org/story/11/12/17/1735253/gpl-copyleft-use-declining-fast https://developers.slashdot.org/story/11/12/17/1735253/gpl-c...
Quequau 7y ago
Back in the '90s we got a dev kit for a microcontroller (Toshiba if I recall) that had language in the license that specifically forbade using the thing in terrorist acts. So I don't think this is new.
- smhenderson 7y ago
  That’s not really them pushing an ethical position though IMO. That’s more of a cover their butt clause. It’s put in the terms under the belief that if someone does use their product in a terrorist act anyone who suffered from it can’t sue them as they expressly forbade the acts in their license.
  - jessaustin 7y ago
    That might have been the intent, but it wouldn't work. Otherwise firearms would be sold with some sort of "I promise not to shoot anyone in circumstances that a court won't later approve" agreement.
    - extra88 7y ago
      Now that the Supreme Court has allowed the families of victims of Sandy Hook to sue a gun manufacturer, there will be a case that looks at their liability. https://www.npr.org/2019/11/12/778487920/supreme-court-allows-sandy-hook-families-case-against-remington-to-proceed https://www.npr.org/2019/11/12/778487920/supreme-court-allow...
      - pessimizer 7y ago
        But etching "we are not liable" on the side of the gun would not help.
        extra88 7y ago
        Printing "this is not a toy" on dry cleaner bags doesn't help either and yet there it is.
nabla9 7y ago
These typical naive tv-plot contracts: You write outrageous terms into a contract form and it becomes a binding under the law is both parties agree. It seems that some people are so naive that they really think this is how the contract law works.
belorn 7y ago
With all due respect to the author, I don't follow the logic of many of the claims in the article. > However, consider enforcing the Vaccine License: imagine explaining to a judge that someone consented to be injected with vaccine by using a piece of software, and that they become copyright infringers by failing to get their shots. Lets imagine a too small child illegally entering a amusement park ride that has a minimum height requirement, and an accident happens. The park owner do not need to explain to a judge how the child agreed to inject growth hormones by entering the ride. The requirement does not specify the way of how an individual may achieve compliance, only the measurable state which compliance may be determined. The Vaccine License is no more complicated than licenses that specific that you can't ship software to countries which the US has an export ban in regard to encryption. The export ban specific a target demographic which the software can not be sold and/or use it. The Vaccine License specific a target demographic which may not copy it, and/or use it. The second argument brought up is that you can't sue a citizen of sovereign countries for behavior that their governments do. Again we can look at US export bans. you don't need to enforce the condition by suing people in those countries. It is generally enough that international companies has to follow the condition. The third argument is that since none of these licenses routinely require any royalties, the likely damages by infringers would be zero. That is not how damages get calculated. Existing royalties can be used as a guideline, but the common argument is to claim damages based on "industry standard". If a infringer publish unreleased work (say a copyrighted movie before release) it also has no existing royalties, but that hasn't stopped judges from issuing rather high damages. Context matter in court cases. The forth argument being that the term was illegal, improper or unenforceable. As someone who has been standing on that side of the fence in regard to EULAs and privacy policies I sincerely wish it was so. That basically leaves the last argument that enforcing licenses are too costly. I fully agree. Its like shoplifting which has less than 1% clearing rate. A lot of shop owners where I live have stopped even reporting thefts because they find the time doing the phone call is most costly than its worth. This is one place where personal principles has to weight more than financial sense. If someone steal your stuff, be that in a shop or a copyright, then you file a police report. It will likely not result in anything but it is better than nothing.
pessimizer 7y ago
The GPL is also an ethical license, and a lot of us buy into it. A lot of us might buy into some future, different license, and the resources for enforcement will come from the people who support it. It's only the OSI license that's some kind of libertarian commons thing. The GPL comes with obligations, and people are free to avoid the GPL for that reason, or simply violate it and deal with any consequences of that. All of these arguments apply as much to the GPL as to hypothetical "don't eat meat" or "don't steal jokes" licenses.
- ThrowawayR2 7y ago
  > "The GPL comes with obligations" The GPL does not impose any obligations unless the user attempts to redistribute the work that is GPLed, which most users don't. The text even freely acknowledges that the user is not even required to accept the terms of the GPL ("5. You are not required to accept this License, since you have not signed it. ...")
  - shadowgovt 7y ago
    And the Vaccine License does not impose any limitations unless users attempt to use the software without having vaccinations. I think the details of what limitations the licenses impose is splitting hairs; the point is they impose limitations.
    - cycloptic 7y ago
      It really is not. The only reason the GPL has any conditions at all is to preserve the original terms of the license past the first distribution. The conditions don't trigger on use of the software, they trigger upon copying. That is what is meant by "copyleft". Compare this to the vaccine license that apparently demands users purchase medical treatments (???) from an unrelated third party before they can even use the software at all.
- catalogia 7y ago
  > "OSI license" What is that even supposed to mean? There is no OSI-approved license that goes by that name, nor in fact any license at all with that name as far as I can find. Incidentally the GPL is an OSI-approved license.
Dotnaught 7y ago
On a related note, Perens resigned from the OSI last week over concerns about the Cryptographic Autonomy License: https://www.theregister.co.uk/2020/01/03/osi_cofounder_resigns/ https://www.theregister.co.uk/2020/01/03/osi_cofounder_resig...
- dang 7y ago
  Discussed here: https://news.ycombinator.com/item?id=21958105 https://news.ycombinator.com/item?id=21958105
redavni 7y ago
These things are resume filler for people looking for jobs in the non-profit sector.
mark_l_watson 7y ago
I agree with Bruce, these licenses may be the results of good intentions but they are probably unenforceable, and if I may add: they are silly.
est31 7y ago
FLOSS is a very good cause and it attracts people with an open heart who do care about good causes. However, the goal of FLOSS is not to be a guardian of how people should live, nor should it be a judge or a police to prevent or sanction the evil in this world. There are different and better venues for this! If I see a project adopt such a license then for me it's a sign of immaturity and not being able to manage the power that being a maintainer brings. I'd definitely try to avoid such software as it doesn't fulfil the four freedoms and thus isn't FLOSS.

125 points by kick 7y ago

The Debian Free Software Guidelines (DFSG) (and their "Social Contract" with the Free Software Community for that matter) [1] are very short documents, and I recommend anyone reading them. Created in 1997, and only slightly changed once in 2004, they are a staple of free and open source software. [1] https://www.debian.org/social_contract#guidelines https://www.debian.org/social_contract#guidelines

est31 7y ago
IIRC the OSI criteria were even modeled after the DFSG. OSI was basically a project to decide which license is open source outside of a Debian context.
- kick 7y ago
  Perens wrote both, so yeah, though OSI was just to make free software more corporate-friendly.

saagarjha 7y ago

Plus I’ve heard that these make this difficult to use by “legitimate” entities too since they’re non-standard and hence require more legal scrutiny.

fhars 7y ago
Yes, the canonical example is the good old „I give permission for IBM to use JSLint for evil“: https://news.ycombinator.com/item?id=5138866 https://news.ycombinator.com/item?id=5138866
- hoistbypetard 7y ago
  Which has since gone away but can be found here: http://web.archive.org/web/20110418031915/http://dev.hasenj.org/post/3272592502/ibm-and-its-minions http://web.archive.org/web/20110418031915/http://dev.hasenj....

Latty 7y ago

I doubt anyone using these kinds of licenses really thinks they are going to "work" from the point of view of significantly limiting that behaviour. They do, however, act as a way to advertise the issues—this article being an example of how using a license like that causes people to publicise and maybe think about your issues. The final suggestion in the article is working to enact better laws: starting and maintaining the conversation is the first step to doing that.

rwmj 7y ago
They also act to stop people using your software since it won't be packaged in Linux distros and any companies considering it will run a mile as soon as they run it past their lawyers.
- catalogia 7y ago
  If you want average Joes to use your software freely but dislike corporations, then picking a license that makes lawyers run might be the way to go. Or just use WTFPL and count on the profanity to offend conservative business sorts.
  - jsjohnst 7y ago
    > then picking a license that makes lawyers run might be the way to go In most of corporate America, that would be GPL or AGPL licenses, from direct experience working with outside council at multiple employers defining licensing policies.
    - catalogia 7y ago
      Yes, AGPLv3 is a crowd favorite for flipping corporate users the bird.
    - tyingq 7y ago
      AGPL maybe, but GPL doesn't seem to be a barrier. Linux, Emacs, MySQL, gcc, git, OpenJDK, etc...are everywhere in corporate America. Perhaps for libraries you link to that aren't LGPL.

msla 7y ago

The only possible purpose of these licenses is to act as Super Codes of Conduct, CoCs which can "kick out" people who aren't in the project by making it too difficult for them to keep using the software when one of the contributors could pull the trigger on legal action. The action doesn't have to be successful to be expensive to fight, after all; it's the old troll tactic of making the danegeld less expensive than the battle would be. Poof. Now anyone you don't like can't even use the software, let alone fork it and go their own direction with it. Ballmer could hardly have done it better.

upofadown 7y ago
Nothing to do with the project, everything to do with the users.
matheusmoreira 7y ago
They can just ignore the license if they want/need the software that much. Seriously doubt random users are gonna get sued for violating terms.
- msla 7y ago
  > They can just ignore the license if they want/need the software that much. Seriously doubt random users are gonna get sued for violating terms. By all means tap-dance in the minefield. You'll probably be fine. Arbitrary enforcement is the cornerstone of a good, solid chilling effect. Finally, as a point of policy, I'd rather people not get the idea that OSS licenses are ignorable. That's even more Ballmer-esque in its implications.

Proven 7y ago

> The idea behind this was that Freedom meant Freedom for everyone, not just Freedom for people we approved of. It's not freedom for everyone. It cannot be used by those who do not accept the license. If they do accept it, it limits their rights to use, modify and redistribute the software within limits spelled out in the license. "You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License" Most people here refuse to understand that "freedom" can't be given by a license. It can stay the same, or become restricted (when a license imposes a duty or obligation on the licensee). The ethical licenses are a nonsense. Even the name is awful (how is it ethical to attempt to restrict another person's freedom?) Thankfully no project that I know or care about uses one of those.

zAy0LfpBZLC8mAC 7y ago
> how is it ethical to attempt to restrict another person's freedom? By preventing greater harm to others that would result if you didn't. Seriously, that wasn't obvious?
- jessaustin 7y ago
  I smell authoritarians...
MaxBarraclough 7y ago
> It cannot be used by those who do not accept the license. This is wrong. You don't have to accept the terms of the GPL if you use a program, only if you distribute and/or modify it. https://opensource.stackexchange.com/a/2867/ https://opensource.stackexchange.com/a/2867/ From the text of the GPLv3: You are not required to accept this License in order to receive or run a copy of the Program. The Affero GPL is unusual, but even there, you don't have to accept the licence merely to run a program. > If they do accept it, it limits their rights to use, modify and redistribute the software within limits spelled out in the license. Again, no, it doesn't restrict the right to use. > Most people here refuse to understand that "freedom" can't be given by a license. It can stay the same, or become restricted (when a license imposes a duty or obligation on the licensee). That's wrong. You don't have rights to use/study/distribute/modify/modify+distribute software unless the software is in the public domain, or if those rights are actively granted to you by a licence. If you happen to stumble across some source code, and it's still under copyright, and there's no licence, then you have no right to it. Same goes if you find an unfinished novel. This is why GitHub took steps to encourage people to add a clearly stated licence to their projects. If you want to make the case for permissive BSD-style licences being 'more free' than copyleft licences, then sure, that's a debate we could have, but freedom absolutely is given by licences. > how is it ethical to attempt to restrict another person's freedom? Banning kidnapping and slavery increases the total freedom in a country. Copyleft operates on a similar principle, prohibiting people from taking Free software and using it as the basis for non-Free software. The copyleft-vs-permissive-licence debate I mentioned above, is as old as Free Software. Here's an old Slashdot thread where the usual points are made: https://developers.slashdot.org/story/11/12/17/1735253/gpl-copyleft-use-declining-fast https://developers.slashdot.org/story/11/12/17/1735253/gpl-c...

Quequau 7y ago

Back in the '90s we got a dev kit for a microcontroller (Toshiba if I recall) that had language in the license that specifically forbade using the thing in terrorist acts. So I don't think this is new.

smhenderson 7y ago
That’s not really them pushing an ethical position though IMO. That’s more of a cover their butt clause. It’s put in the terms under the belief that if someone does use their product in a terrorist act anyone who suffered from it can’t sue them as they expressly forbade the acts in their license.
- jessaustin 7y ago
  That might have been the intent, but it wouldn't work. Otherwise firearms would be sold with some sort of "I promise not to shoot anyone in circumstances that a court won't later approve" agreement.
  - extra88 7y ago
    Now that the Supreme Court has allowed the families of victims of Sandy Hook to sue a gun manufacturer, there will be a case that looks at their liability. https://www.npr.org/2019/11/12/778487920/supreme-court-allows-sandy-hook-families-case-against-remington-to-proceed https://www.npr.org/2019/11/12/778487920/supreme-court-allow...
    - pessimizer 7y ago
      But etching "we are not liable" on the side of the gun would not help.
      - extra88 7y ago
        Printing "this is not a toy" on dry cleaner bags doesn't help either and yet there it is.

nabla9 7y ago

These typical naive tv-plot contracts: You write outrageous terms into a contract form and it becomes a binding under the law is both parties agree. It seems that some people are so naive that they really think this is how the contract law works.

belorn 7y ago

With all due respect to the author, I don't follow the logic of many of the claims in the article. > However, consider enforcing the Vaccine License: imagine explaining to a judge that someone consented to be injected with vaccine by using a piece of software, and that they become copyright infringers by failing to get their shots. Lets imagine a too small child illegally entering a amusement park ride that has a minimum height requirement, and an accident happens. The park owner do not need to explain to a judge how the child agreed to inject growth hormones by entering the ride. The requirement does not specify the way of how an individual may achieve compliance, only the measurable state which compliance may be determined. The Vaccine License is no more complicated than licenses that specific that you can't ship software to countries which the US has an export ban in regard to encryption. The export ban specific a target demographic which the software can not be sold and/or use it. The Vaccine License specific a target demographic which may not copy it, and/or use it. The second argument brought up is that you can't sue a citizen of sovereign countries for behavior that their governments do. Again we can look at US export bans. you don't need to enforce the condition by suing people in those countries. It is generally enough that international companies has to follow the condition. The third argument is that since none of these licenses routinely require any royalties, the likely damages by infringers would be zero. That is not how damages get calculated. Existing royalties can be used as a guideline, but the common argument is to claim damages based on "industry standard". If a infringer publish unreleased work (say a copyrighted movie before release) it also has no existing royalties, but that hasn't stopped judges from issuing rather high damages. Context matter in court cases. The forth argument being that the term was illegal, improper or unenforceable. As someone who has been standing on that side of the fence in regard to EULAs and privacy policies I sincerely wish it was so. That basically leaves the last argument that enforcing licenses are too costly. I fully agree. Its like shoplifting which has less than 1% clearing rate. A lot of shop owners where I live have stopped even reporting thefts because they find the time doing the phone call is most costly than its worth. This is one place where personal principles has to weight more than financial sense. If someone steal your stuff, be that in a shop or a copyright, then you file a police report. It will likely not result in anything but it is better than nothing.

pessimizer 7y ago

The GPL is also an ethical license, and a lot of us buy into it. A lot of us might buy into some future, different license, and the resources for enforcement will come from the people who support it. It's only the OSI license that's some kind of libertarian commons thing. The GPL comes with obligations, and people are free to avoid the GPL for that reason, or simply violate it and deal with any consequences of that. All of these arguments apply as much to the GPL as to hypothetical "don't eat meat" or "don't steal jokes" licenses.

ThrowawayR2 7y ago
> "The GPL comes with obligations" The GPL does not impose any obligations unless the user attempts to redistribute the work that is GPLed, which most users don't. The text even freely acknowledges that the user is not even required to accept the terms of the GPL ("5. You are not required to accept this License, since you have not signed it. ...")
- shadowgovt 7y ago
  And the Vaccine License does not impose any limitations unless users attempt to use the software without having vaccinations. I think the details of what limitations the licenses impose is splitting hairs; the point is they impose limitations.
  - cycloptic 7y ago
    It really is not. The only reason the GPL has any conditions at all is to preserve the original terms of the license past the first distribution. The conditions don't trigger on use of the software, they trigger upon copying. That is what is meant by "copyleft". Compare this to the vaccine license that apparently demands users purchase medical treatments (???) from an unrelated third party before they can even use the software at all.
catalogia 7y ago
> "OSI license" What is that even supposed to mean? There is no OSI-approved license that goes by that name, nor in fact any license at all with that name as far as I can find. Incidentally the GPL is an OSI-approved license.

Dotnaught 7y ago

On a related note, Perens resigned from the OSI last week over concerns about the Cryptographic Autonomy License: https://www.theregister.co.uk/2020/01/03/osi_cofounder_resigns/ https://www.theregister.co.uk/2020/01/03/osi_cofounder_resig...

dang 7y ago
Discussed here: https://news.ycombinator.com/item?id=21958105 https://news.ycombinator.com/item?id=21958105

redavni 7y ago

These things are resume filler for people looking for jobs in the non-profit sector.

mark_l_watson 7y ago

I agree with Bruce, these licenses may be the results of good intentions but they are probably unenforceable, and if I may add: they are silly.

est31 7y ago

FLOSS is a very good cause and it attracts people with an open heart who do care about good causes. However, the goal of FLOSS is not to be a guardian of how people should live, nor should it be a judge or a police to prevent or sanction the evil in this world. There are different and better venues for this! If I see a project adopt such a license then for me it's a sign of immaturity and not being able to manage the power that being a maintainer brings. I'd definitely try to avoid such software as it doesn't fulfil the four freedoms and thus isn't FLOSS.