9 ms·

One downside they don't mention is that the license restricts who can contribute to your project. When I worked at Google (2014-2018), it was easy to get permi

One downside they don't mention is that the license restricts who can contribute to your project. When I worked at Google (2014-2018), it was easy to get permission to contribute to open source projects as long as the license was BSD, MIT, or Apache 2.0. The more restrictive licenses like GPL 2 or AGPL, I think Google either flat out denied or you had to do a lot more work to get permission. Now that I work for myself, I much prefer not having to ask anyone for permission to contribute to open source, but I generally default to MIT/Apache2 unless I have a reason to do otherwise, out of consideration for employees at Google or other corps who may want to participate in my project.

slim 6y ago
genuine question : why would you ask for permission ?
- sascha_sl 6y ago
  Maybe that's a concept unknown outside that bubble of software developers, but lots of companies stipulate this in contracts; maybe you don't want to risk getting fired in case you don't (want to) maintain perfect opsec for... a side project?
- jlgaddis 6y ago
  At Google, et al, because that's what you agreed to do when you accepted the job.
  - _msw_ 6y ago
    Disclosure: I work at Amazon where I build infrastructure servies for AWS Since Amazon is frequently lumped in with Google et al., I think there is common belief that they are roughly the same. Amazon has an Outside Activity policy that covers some employees (certainly all tech employees). For the vast majority of outside work activity that triggers the policy, you simply fill out a notification form that logs an affirmation that the activity does not trigger further review. The license of open-source software that you want to contribute to on your own time is not part of the policy that would trigger further review. In other words, so long as developing that software is permitted by the outside activity policy, you are free to develop and make software available under AGPL on your own time while being an Amazon employee.
- izacus 6y ago
  Because the code is owned by the company if you're writing it during your job / working hours.
  - trisiak 6y ago
    Most likely it goes far beyond that. California does have explicit provisions that protects your contributions outside of working hours, if done on your own hardware, and if they are unrelated to what your company is doing. Other states don't. A good reading that covers this very topic really well: https://www.joelonsoftware.com/2016/12/09/developers-side-projects/ https://www.joelonsoftware.com/2016/12/09/developers-side-pr...
    - saagarjha 6y ago
      If you work at Google then that clause protects you much less than you'd think.
  - mtlynch 6y ago
    At Google (and most big companies, I believe), the rules apply to all work, not just working hours. Joel Spolsky has a good article explaining the rationale: https://www.joelonsoftware.com/2016/12/09/developers-side-projects/ https://www.joelonsoftware.com/2016/12/09/developers-side-pr...
    - ship_it 6y ago
      How can something I wrote off-hours be the product of my employer? What if I 3D print a new window at my house? Is that also my employers product?
      - mtlynch 6y ago
        FTA: >Suppose, now, you have a little game company. Instead of making software, you knock out three or four clever games every few months. You can’t invent all the games yourself. So you go out and hire a game designer to invent games. You are going to pay the game designer $6,000 a month to invent new games. Those games will be clever and novel. They are patentable. It is important to you, as a company, to own the patents on the games. >Your game designer works for a year and invents 7 games. At the end of the year, she sues you, claiming that she owns 4 of them, because those particular games were invented between 5pm and 9am, when she wasn’t on duty. >Ooops. That’s not what you meant. You wanted to pay her for all the games that she invents, and you recognize that the actual process of invention for which you are paying her may happen at any time… on weekdays, weekends, in the office, in the cubicle, at home, in the shower, climbing a mountain on vacation.
- corty 6y ago
  because if you contribute during work hours, the contribution is legally owned by your employer. If you contribute after work, some jurisdictions also might give the employer rights to that contribution. So the answer is: because the code might not really be yours to contribute.
  - Aeolun 6y ago
    I guess they should then just not pay me for the time I spent working on non-approved stuff.
    - colejohnson66 6y ago
      It’s a bit difficult to do that when your salaried. Because you’re not being paid for the hours you work, but just for being an employee, many states have said that stuff done outside of work could be construed as being “on the clock”
      - Aeolun 6y ago
        Ah, not where I work. If I work any less than 40 hours they substract it from my salary, even though it’s the closest thing we have to a salaried position.
        colejohnson66 6y ago
        Isn’t that just hourly with no overtime pay then? That sounds ridiculous
        Aeolun 6y ago
        Hmm, if you put it like that. Yes, I guess that’s how it works :/ Ultimately overtime is paid, but the first 45 hours every month are ‘included’ in the salary.
        deleted 6y ago
        [deleted]
sascha_sl 6y ago
This is unfortunate, but ultimately it's all about control, and who can reasonably fulfill the requirements in these licenses. The AGPL is specifically made to only allow other very open source friendly shops to use your code that are likely to contribute back, or require a special paid agreement on the side. It's still much nicer than the "code available but not freely usable" model because it has built in exceptions for hobbyists and businesses with a model of software development that you support.
belorn 6y ago
If an employee want permission from their employer to spend work hours on contributing code to other projects and companies it make some sense that the employer will have an opinion on what that work is. They employer is after all paying for it, even if its given as a "perk". Personally however I would not spend to much energy and time worrying about that. I don't expect google to pay programmers to support my side projects, and I would be actually a bit worry if they contributed to anything critical at the place where i work. Google might find coexistence acceptable today, but if they have paid employees to work on code for a competing company (even if its just for one of their commercial products) then I would see a risk that one day they would prefer to own what they are today giving out for free.
- singron 6y ago
  Unfortunately if you work at Google, you need permission from Google to work on anything outside of work with your own equipment in almost any domain. Even if the you benefit from moonlighting laws in California, Google is such a huge corporation that almost any project you would contribute to could be related to their business (even if it's not related to the work you do for them). I would love an update to moonlighting laws that acknowledged megacorps.
panny 6y ago
>When I worked at Google (2014-2018), it was easy to get permission to contribute to open source projects as long as the license was BSD, MIT, or Apache 2.0. The more restrictive licenses like GPL 2 or AGPL, I think Google either flat out denied or you had to do a lot more work to get permission. Personally, I consider that a feature rather than a bug. There's a list of these licenses [1] and I make sure my software uses one of those on the list. [1] https://opensource.google/docs/thirdparty/licenses/#banned https://opensource.google/docs/thirdparty/licenses/#banned
- aviraldg 6y ago
  To avoid contributors from Google is ... a feature? What exactly is your problem with them?
  - Aeolun 6y ago
    They’re evil?
    - wegs 6y ago
      Microsoft was evil. A pile of GPL code winning was part of what made them stop being evil. Shipping code under Google banned licenses can be thought of as either: 1) Excluding Googlers, which isn't very nice. 2) Applying pressure to de-evil Google, which is very nice and benefits everyone. I'd like to have a non-evil Google again. I really miss the old non-evil, brilliant Google. Organizations change.
      - adambyrtek 6y ago
        What about 3) don't care about Google? Do I really have to consider every big company when choosing a licence for my own personal project?
    - marcinzm 6y ago
      No, Google employees as a whole are not evil. I feel that in 2020 we should all be aware of how bad judging whole groups for the actions of a minority are.
tsss 6y ago
I actually have a library that is Mozilla licensed and gets some contributions from the likes of Google, Uber, Airbnb and so on. Mozilla license is similar to GPL in the sense that it also commands you to publish your code in some situations, so I would expect Google to outlaw this license as well, but so far I haven' received any complaints and I don't think the contributors would go out of their way to get permission from higher-ups at Google. Perhaps they didn't notice what terms the Mozilla license implies.
- joerichey 6y ago
  At Google, MPL (and other copyleft licenses) are OK for internal use and for external contributions. I think we have a mirroring system setup to automatically publish any internal changes. Edit: See https://opensource.google/docs/thirdparty/licenses/#reciprocal https://opensource.google/docs/thirdparty/licenses/#reciproc... for the public info about mirroring.
pyrale 6y ago
This sounds like a google problem to me. Reshaping it as a Faustian bargain for maintainers seems particularly disingenuous.
- mtlynch 6y ago
  I didn't mean to present it as if it's immoral to choose a license that excludes Googlers. The maintainer should be free to choose whatever license meets their goals. Out of personal self-interest, I want to maximize the number of people who are eligible to contribute to my project. If it's unlikely for anyone to use my code to compete against me or form a different business without compensating me, I default to a permissive license because it allows more people to contribute.
  - enriquto 6y ago
    > a license that excludes Googlers. This is not the case. The AGPL license does not exclude googlers. It's Google that excludes googlers.
  - eeZah7Ux 6y ago
    > choose a license that excludes Googlers This is entirely google's decision. It's obviously not a decision made to help FLOSS or FLOSS developers. > Out of personal self-interest, I want to maximize the number of people who are eligible to contribute to my project. I don't want to maximize the number of organizations taking my software, locking it down, renaming it and ultimately competing AGAINST my user community.
joerichey 6y ago
As a current Google employee, the OSS contribution process has gotten way better. Basically, anything that is BSD/MIT/Apache/LGPL/GPL/EPL/MPL no longer needs approval. AGPL and the non-commercial licenses are still banned. Edit: The Google OSS contribution guidelines are actually public, if anyone wants to take a look: https://opensource.google/docs/patching/ https://opensource.google/docs/patching/
- mtlynch 6y ago
  Oh, cool. That's good news!
- Aeolun 6y ago
  How is AGPL noncommercial? You can definitely still sell the service as long as you publish the source.
  - est31 6y ago
    GP said "AGPL and the noncommercial licenses". Means they are two separate categories.
- boogies 6y ago
  (deeper link: https://opensource.google/docs/patching/#forbidden https://opensource.google/docs/patching/#forbidden)
- SSLy 6y ago
  Which projects require SVP sign-off?
- Doctor_Fegg 6y ago
  Your periodic reminder: as the Google rules demonstrate, WTFPL works really well as a permissive-except-for-bigcos licence.
  - joerichey 6y ago
    Personally, I would use an explicit non-commercial license in this case. WTFPL isn't a real license (and isn't considered open-source by OSI). Things like the AGPL and CC-BY-NC-* are actually written by lawyers and make it clear what you actually want.
cycloptic 6y ago
> One downside they don't mention is that the license restricts who can contribute to your project. In that case Google's policy is what is restricting you, not the license. The AGPL doesn't say you can't contribute if you work for Google. I'm sure AGPL users (like the company in TFA) wouldn't mind if Google reversed their policy and gave their employees permission to contribute.
- mtlynch 6y ago
  >In that case Google's policy is what is restricting you, not the license. In this context, I don't think the distinction matters. If I was choosing ingredients for a brownie to sell, using THC would restrict which US residents can buy my brownies. Is it the fault of the lawmakers in my customer's state? Or is it my fault for choosing an ingredient that's banned in most US states? If I'm trying to maximize sales, the question of blame is irrelevant. From a practical standpoint, it doesn't matter whose "fault" it is that a Googler can't contribute to an AGPL project. Choosing an AGPL or similar license prevents me from receiving contributions from people who otherwise might be interested in contributing.
  - cycloptic 6y ago
    >Is it the fault of the lawmakers in my customer's state? Unquestionably, yes. They know exactly what kind of business they were looking to restrict with those laws, and in your analogy they stuck all the fallout from that on you. (That's not to say one shouldn't be civic-minded, but for the record I tend to avoid analogies when talking about this because they more often seem to confuse the issue than actually explain what is happening)
    - remram 6y ago
      If you think using THC in your goods makes you that "kind of business", do you think being AGPL makes you that "kind of project"? If you do, you can hardly blame Google for making the same distinction.
      - 6y ago
cdibona 6y ago
I just wanted to point out that we've never restricted gplv2 or v3 contributions. AGPL? Sure. But The GPLs have always been mainstreamed for us. Have we made contributing to all allowed project/licenses more efficient over the years? For sure :-) Maybe that's what you noticed. We switched to asychronous permissions for 99%+ of all patches.
- mtlynch 6y ago
  Thanks for the correction, Chris! I must have misremembered the process for GPLv2.
kelnos 6y ago
> I generally default to MIT/Apache2 unless I have a reason to do otherwise, out of consideration for employees at Google or other corps who may want to participate in my project. That's kinda a sad state of affairs that you're allowing corporate policy (of companies that you don't work for) to effectively dictate your licensing strategy. Not saying you're wrong to do so (it's your project; you know best), but the overall gist of it feels a little dystopian. Ultimately Google is applying pressure -- even if unintentionally -- to the community at large: "use a license we're happy with, or you'll have a smaller pool of contributors"[0]. If AGPL was a majority license for projects like these, then Google would likely have no choice but to allow contributions to AGPL projects. [0] Note that that's different from an individual deciding (for whatever reason) that they don't want to contribute to projects that use certain licenses (which is fine!). Google's policy forces an unreasonable restriction on their employees that their employees may not agree with, but can't argue with because of the employer-employee power imbalance.
- de-moray 6y ago
  How is that an unreasonable restriction for Google to ensure the work they pay for is usable in the company's products

slim 6y ago

genuine question : why would you ask for permission ?

sascha_sl 6y ago
Maybe that's a concept unknown outside that bubble of software developers, but lots of companies stipulate this in contracts; maybe you don't want to risk getting fired in case you don't (want to) maintain perfect opsec for... a side project?
jlgaddis 6y ago
At Google, et al, because that's what you agreed to do when you accepted the job.
- _msw_ 6y ago
  Disclosure: I work at Amazon where I build infrastructure servies for AWS Since Amazon is frequently lumped in with Google et al., I think there is common belief that they are roughly the same. Amazon has an Outside Activity policy that covers some employees (certainly all tech employees). For the vast majority of outside work activity that triggers the policy, you simply fill out a notification form that logs an affirmation that the activity does not trigger further review. The license of open-source software that you want to contribute to on your own time is not part of the policy that would trigger further review. In other words, so long as developing that software is permitted by the outside activity policy, you are free to develop and make software available under AGPL on your own time while being an Amazon employee.
izacus 6y ago
Because the code is owned by the company if you're writing it during your job / working hours.
- trisiak 6y ago
  Most likely it goes far beyond that. California does have explicit provisions that protects your contributions outside of working hours, if done on your own hardware, and if they are unrelated to what your company is doing. Other states don't. A good reading that covers this very topic really well: https://www.joelonsoftware.com/2016/12/09/developers-side-projects/ https://www.joelonsoftware.com/2016/12/09/developers-side-pr...
  - saagarjha 6y ago
    If you work at Google then that clause protects you much less than you'd think.
- mtlynch 6y ago
  At Google (and most big companies, I believe), the rules apply to all work, not just working hours. Joel Spolsky has a good article explaining the rationale: https://www.joelonsoftware.com/2016/12/09/developers-side-projects/ https://www.joelonsoftware.com/2016/12/09/developers-side-pr...
  - ship_it 6y ago
    How can something I wrote off-hours be the product of my employer? What if I 3D print a new window at my house? Is that also my employers product?
    - mtlynch 6y ago
      FTA: >Suppose, now, you have a little game company. Instead of making software, you knock out three or four clever games every few months. You can’t invent all the games yourself. So you go out and hire a game designer to invent games. You are going to pay the game designer $6,000 a month to invent new games. Those games will be clever and novel. They are patentable. It is important to you, as a company, to own the patents on the games. >Your game designer works for a year and invents 7 games. At the end of the year, she sues you, claiming that she owns 4 of them, because those particular games were invented between 5pm and 9am, when she wasn’t on duty. >Ooops. That’s not what you meant. You wanted to pay her for all the games that she invents, and you recognize that the actual process of invention for which you are paying her may happen at any time… on weekdays, weekends, in the office, in the cubicle, at home, in the shower, climbing a mountain on vacation.
corty 6y ago
because if you contribute during work hours, the contribution is legally owned by your employer. If you contribute after work, some jurisdictions also might give the employer rights to that contribution. So the answer is: because the code might not really be yours to contribute.
- Aeolun 6y ago
  I guess they should then just not pay me for the time I spent working on non-approved stuff.
  - colejohnson66 6y ago
    It’s a bit difficult to do that when your salaried. Because you’re not being paid for the hours you work, but just for being an employee, many states have said that stuff done outside of work could be construed as being “on the clock”
    - Aeolun 6y ago
      Ah, not where I work. If I work any less than 40 hours they substract it from my salary, even though it’s the closest thing we have to a salaried position.
      - colejohnson66 6y ago
        Isn’t that just hourly with no overtime pay then? That sounds ridiculous
        Aeolun 6y ago
        Hmm, if you put it like that. Yes, I guess that’s how it works :/ Ultimately overtime is paid, but the first 45 hours every month are ‘included’ in the salary.
        deleted 6y ago
        [deleted]

sascha_sl 6y ago

This is unfortunate, but ultimately it's all about control, and who can reasonably fulfill the requirements in these licenses. The AGPL is specifically made to only allow other very open source friendly shops to use your code that are likely to contribute back, or require a special paid agreement on the side. It's still much nicer than the "code available but not freely usable" model because it has built in exceptions for hobbyists and businesses with a model of software development that you support.

belorn 6y ago

If an employee want permission from their employer to spend work hours on contributing code to other projects and companies it make some sense that the employer will have an opinion on what that work is. They employer is after all paying for it, even if its given as a "perk". Personally however I would not spend to much energy and time worrying about that. I don't expect google to pay programmers to support my side projects, and I would be actually a bit worry if they contributed to anything critical at the place where i work. Google might find coexistence acceptable today, but if they have paid employees to work on code for a competing company (even if its just for one of their commercial products) then I would see a risk that one day they would prefer to own what they are today giving out for free.

singron 6y ago
Unfortunately if you work at Google, you need permission from Google to work on anything outside of work with your own equipment in almost any domain. Even if the you benefit from moonlighting laws in California, Google is such a huge corporation that almost any project you would contribute to could be related to their business (even if it's not related to the work you do for them). I would love an update to moonlighting laws that acknowledged megacorps.

panny 6y ago

>When I worked at Google (2014-2018), it was easy to get permission to contribute to open source projects as long as the license was BSD, MIT, or Apache 2.0. The more restrictive licenses like GPL 2 or AGPL, I think Google either flat out denied or you had to do a lot more work to get permission. Personally, I consider that a feature rather than a bug. There's a list of these licenses [1] and I make sure my software uses one of those on the list. [1] https://opensource.google/docs/thirdparty/licenses/#banned https://opensource.google/docs/thirdparty/licenses/#banned

aviraldg 6y ago
To avoid contributors from Google is ... a feature? What exactly is your problem with them?
- Aeolun 6y ago
  They’re evil?
  - wegs 6y ago
    Microsoft was evil. A pile of GPL code winning was part of what made them stop being evil. Shipping code under Google banned licenses can be thought of as either: 1) Excluding Googlers, which isn't very nice. 2) Applying pressure to de-evil Google, which is very nice and benefits everyone. I'd like to have a non-evil Google again. I really miss the old non-evil, brilliant Google. Organizations change.
    - adambyrtek 6y ago
      What about 3) don't care about Google? Do I really have to consider every big company when choosing a licence for my own personal project?
  - marcinzm 6y ago
    No, Google employees as a whole are not evil. I feel that in 2020 we should all be aware of how bad judging whole groups for the actions of a minority are.

tsss 6y ago

I actually have a library that is Mozilla licensed and gets some contributions from the likes of Google, Uber, Airbnb and so on. Mozilla license is similar to GPL in the sense that it also commands you to publish your code in some situations, so I would expect Google to outlaw this license as well, but so far I haven' received any complaints and I don't think the contributors would go out of their way to get permission from higher-ups at Google. Perhaps they didn't notice what terms the Mozilla license implies.

joerichey 6y ago
At Google, MPL (and other copyleft licenses) are OK for internal use and for external contributions. I think we have a mirroring system setup to automatically publish any internal changes. Edit: See https://opensource.google/docs/thirdparty/licenses/#reciprocal https://opensource.google/docs/thirdparty/licenses/#reciproc... for the public info about mirroring.

pyrale 6y ago

This sounds like a google problem to me. Reshaping it as a Faustian bargain for maintainers seems particularly disingenuous.

mtlynch 6y ago
I didn't mean to present it as if it's immoral to choose a license that excludes Googlers. The maintainer should be free to choose whatever license meets their goals. Out of personal self-interest, I want to maximize the number of people who are eligible to contribute to my project. If it's unlikely for anyone to use my code to compete against me or form a different business without compensating me, I default to a permissive license because it allows more people to contribute.
- enriquto 6y ago
  > a license that excludes Googlers. This is not the case. The AGPL license does not exclude googlers. It's Google that excludes googlers.
- eeZah7Ux 6y ago
  > choose a license that excludes Googlers This is entirely google's decision. It's obviously not a decision made to help FLOSS or FLOSS developers. > Out of personal self-interest, I want to maximize the number of people who are eligible to contribute to my project. I don't want to maximize the number of organizations taking my software, locking it down, renaming it and ultimately competing AGAINST my user community.

joerichey 6y ago

As a current Google employee, the OSS contribution process has gotten way better. Basically, anything that is BSD/MIT/Apache/LGPL/GPL/EPL/MPL no longer needs approval. AGPL and the non-commercial licenses are still banned. Edit: The Google OSS contribution guidelines are actually public, if anyone wants to take a look: https://opensource.google/docs/patching/ https://opensource.google/docs/patching/

mtlynch 6y ago
Oh, cool. That's good news!
Aeolun 6y ago
How is AGPL noncommercial? You can definitely still sell the service as long as you publish the source.
- est31 6y ago
  GP said "AGPL and the noncommercial licenses". Means they are two separate categories.
boogies 6y ago
(deeper link: https://opensource.google/docs/patching/#forbidden https://opensource.google/docs/patching/#forbidden)
SSLy 6y ago
Which projects require SVP sign-off?
Doctor_Fegg 6y ago
Your periodic reminder: as the Google rules demonstrate, WTFPL works really well as a permissive-except-for-bigcos licence.
- joerichey 6y ago
  Personally, I would use an explicit non-commercial license in this case. WTFPL isn't a real license (and isn't considered open-source by OSI). Things like the AGPL and CC-BY-NC-* are actually written by lawyers and make it clear what you actually want.

cycloptic 6y ago

> One downside they don't mention is that the license restricts who can contribute to your project. In that case Google's policy is what is restricting you, not the license. The AGPL doesn't say you can't contribute if you work for Google. I'm sure AGPL users (like the company in TFA) wouldn't mind if Google reversed their policy and gave their employees permission to contribute.

mtlynch 6y ago
>In that case Google's policy is what is restricting you, not the license. In this context, I don't think the distinction matters. If I was choosing ingredients for a brownie to sell, using THC would restrict which US residents can buy my brownies. Is it the fault of the lawmakers in my customer's state? Or is it my fault for choosing an ingredient that's banned in most US states? If I'm trying to maximize sales, the question of blame is irrelevant. From a practical standpoint, it doesn't matter whose "fault" it is that a Googler can't contribute to an AGPL project. Choosing an AGPL or similar license prevents me from receiving contributions from people who otherwise might be interested in contributing.
- cycloptic 6y ago
  >Is it the fault of the lawmakers in my customer's state? Unquestionably, yes. They know exactly what kind of business they were looking to restrict with those laws, and in your analogy they stuck all the fallout from that on you. (That's not to say one shouldn't be civic-minded, but for the record I tend to avoid analogies when talking about this because they more often seem to confuse the issue than actually explain what is happening)
  - remram 6y ago
    If you think using THC in your goods makes you that "kind of business", do you think being AGPL makes you that "kind of project"? If you do, you can hardly blame Google for making the same distinction.
    - 6y ago

cdibona 6y ago

I just wanted to point out that we've never restricted gplv2 or v3 contributions. AGPL? Sure. But The GPLs have always been mainstreamed for us. Have we made contributing to all allowed project/licenses more efficient over the years? For sure :-) Maybe that's what you noticed. We switched to asychronous permissions for 99%+ of all patches.

mtlynch 6y ago
Thanks for the correction, Chris! I must have misremembered the process for GPLv2.

kelnos 6y ago

> I generally default to MIT/Apache2 unless I have a reason to do otherwise, out of consideration for employees at Google or other corps who may want to participate in my project. That's kinda a sad state of affairs that you're allowing corporate policy (of companies that you don't work for) to effectively dictate your licensing strategy. Not saying you're wrong to do so (it's your project; you know best), but the overall gist of it feels a little dystopian. Ultimately Google is applying pressure -- even if unintentionally -- to the community at large: "use a license we're happy with, or you'll have a smaller pool of contributors"[0]. If AGPL was a majority license for projects like these, then Google would likely have no choice but to allow contributions to AGPL projects. [0] Note that that's different from an individual deciding (for whatever reason) that they don't want to contribute to projects that use certain licenses (which is fine!). Google's policy forces an unreasonable restriction on their employees that their employees may not agree with, but can't argue with because of the employer-employee power imbalance.

de-moray 6y ago
How is that an unreasonable restriction for Google to ensure the work they pay for is usable in the company's products