4 ms·

I think we have to accept that people will reuse and modify the texts of various open source licenses in all sorts of ways which cause downstream confusion. Wh

I think we have to accept that people will reuse and modify the texts of various open source licenses in all sorts of ways which cause downstream confusion. What the FOSS community needs to ensure is that users can always differentiate between a FOSS license and a modified version which has subtle but profound changes. Our best defenses there would seem to be trademarks and social pressure. "That's not actually the AGPL, and calling it the AGPL causes confusion in the marketplace."

itsabug 5y ago
In fact, modifying and updating licenses falls under what I'd consider free speech. The answer to bad license edits is not to shut them down, it's just to write better ones and convince others to use them. I may not agree with bad license edits, but I'll defend them under the right to the free speech of the developer who is shipping the code.
- miffy900 5y ago
  What you're talking about falls under Fair Use. Free speech protections don't provide any such right.
- michaelmrose 5y ago
  It's never been acceptable free speech to sell a fake Rolex watch or a fake Samsung TV and its not a violation of free speech to insist they call it something else. This is a really weird hill to die on.
api 5y ago
All of these headaches stem from the OSI's refusal to address the problems posed by SaaS to the open source model. Their thinking is stuck in the 1980s and 1990s. SaaS is effectively a loophole. You can use 100% open source software to create something that is actually far more proprietary and that offers less user freedom than old school closed source applications. Yes the user can theoretically get the code but it's painful to operate and meanwhile the SaaS application has all the user's data. Open source is rapidly becoming free labor for closed SaaS and a tool to accelerate the lock-down of user data in the cloud rather than a tool to expand user freedom. People are trying to roll their own licenses to deal with these problems since the OSI is providing no leadership.
- jamestanderson 5y ago
  Wasn't the AGPL created to address exactly this loophole?
  - Conan_Kudo 5y ago
    Yes, yes it was.
  - didibus 5y ago
    Isn't this a case of Neo4j trying to prevent a SaaS from making money selling a managed Neo4j offering? It seems the OSI is siding against Neo4j and with the SaaS by saying Neo4j had no rights to remove the right to sell the software from the SaaS company who decided to remove the added clause preventing them from selling Neo4j.
    - kuschku 5y ago
      The goal of the AGPL is that anyone can run a SaaS based on someone else’s code, as long as their own modifications are open as well. Just like the GPL ensures that while Microsoft could take Linux and sell it, they’ll have to make their changes open again.
- kmeisthax 5y ago
  If you're talking about projects where people are following the letter and spirit of the license, and publishing their code, but it's a pain to use... that's not really something you can control with a copyright license. The correct answer in that case is to not use that code and treat projects that rely on it as technical debt. If you mean that the SaaS provider has a private fork of someone else's code, and won't publish that fork... well, AGPL already exists for that. But here's the thing: in order for any license to close this loophole, you need to create a licensing term that obligates the user to publish private forks. These terms will inevitably either restrict the user's freedom to run the program, or the user's freedom to modify the program. I don't see why we should be calling restrictions on either freedom[0] to be Free Software or Open Source. My personal feeling is that companies that are adopting "SaaS-loophole" copylefts are looking for the street cred of being source-available, while still being able to wield copyright in the way one would with proprietary software. Hence the Commons Clause that bans commercial endeavors on top of the already difficult-to-comply-with Affero clause. If you want to be paid, just... demand payment.[1] That's what proprietary licensing is for, and you are never going to close the "SaaS loophole" in FOSS while still remaining in the spirit and letter of FOSS. The thing about SaaS is that it wasn't invented this decade. Even back in the 80s and 90s when FOSS was novel, you had massive IBM mainframes that could be partitioned, virtualized, and rented out exactly in the same way Amazon does today. [0] GPL and weaker copylefts are tolerable because said licensing provisions only trip on distribution. Ordinary users do not need to worry about GPL compliance until they want to give someone else their code. This is a feature, not a bug. [1] Are FOSS support contracts still a thing?
didibus 5y ago
Seems a better solution would be a checksum on the license text no?
- pabs3 5y ago
  The most accurate license detector is ScanCode. I think it uses some sort of rolling checksum thing for detection. https://github.com/nexB/scancode-toolkit/ https://github.com/nexB/scancode-toolkit/
  - pombreda 5y ago
    Hey, pabs3! Actually this is not using a rolling checksum for detection but rather a combo of language model, checksums, automatons, bitvectors, inverted indexes and multiple sequences alignment (e.g. a specialized diff). I put some docs there to explain the approach at ahttps://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/README.rst https://github.com/nexB/scancode-toolkit/blob/develop/src/li...
- pombreda 5y ago
  You need a bit more than checksums for this. If anything the FSF published many different versions of the "official" GPL2 texts and this would defeat checksums. See https://github.com/pombredanne/gpl-history https://github.com/pombredanne/gpl-history ... so in the general cases hashing a text does not work consistently and safely. Eventually you need a diff for a pairwise comparison, and the only difficulty is making diff fast or find ways to approximate it fast enough to avoid doing a full diff.

itsabug 5y ago

In fact, modifying and updating licenses falls under what I'd consider free speech. The answer to bad license edits is not to shut them down, it's just to write better ones and convince others to use them. I may not agree with bad license edits, but I'll defend them under the right to the free speech of the developer who is shipping the code.

miffy900 5y ago
What you're talking about falls under Fair Use. Free speech protections don't provide any such right.
michaelmrose 5y ago
It's never been acceptable free speech to sell a fake Rolex watch or a fake Samsung TV and its not a violation of free speech to insist they call it something else. This is a really weird hill to die on.

api 5y ago

All of these headaches stem from the OSI's refusal to address the problems posed by SaaS to the open source model. Their thinking is stuck in the 1980s and 1990s. SaaS is effectively a loophole. You can use 100% open source software to create something that is actually far more proprietary and that offers less user freedom than old school closed source applications. Yes the user can theoretically get the code but it's painful to operate and meanwhile the SaaS application has all the user's data. Open source is rapidly becoming free labor for closed SaaS and a tool to accelerate the lock-down of user data in the cloud rather than a tool to expand user freedom. People are trying to roll their own licenses to deal with these problems since the OSI is providing no leadership.

jamestanderson 5y ago
Wasn't the AGPL created to address exactly this loophole?
- Conan_Kudo 5y ago
  Yes, yes it was.
- didibus 5y ago
  Isn't this a case of Neo4j trying to prevent a SaaS from making money selling a managed Neo4j offering? It seems the OSI is siding against Neo4j and with the SaaS by saying Neo4j had no rights to remove the right to sell the software from the SaaS company who decided to remove the added clause preventing them from selling Neo4j.
  - kuschku 5y ago
    The goal of the AGPL is that anyone can run a SaaS based on someone else’s code, as long as their own modifications are open as well. Just like the GPL ensures that while Microsoft could take Linux and sell it, they’ll have to make their changes open again.
kmeisthax 5y ago
If you're talking about projects where people are following the letter and spirit of the license, and publishing their code, but it's a pain to use... that's not really something you can control with a copyright license. The correct answer in that case is to not use that code and treat projects that rely on it as technical debt. If you mean that the SaaS provider has a private fork of someone else's code, and won't publish that fork... well, AGPL already exists for that. But here's the thing: in order for any license to close this loophole, you need to create a licensing term that obligates the user to publish private forks. These terms will inevitably either restrict the user's freedom to run the program, or the user's freedom to modify the program. I don't see why we should be calling restrictions on either freedom[0] to be Free Software or Open Source. My personal feeling is that companies that are adopting "SaaS-loophole" copylefts are looking for the street cred of being source-available, while still being able to wield copyright in the way one would with proprietary software. Hence the Commons Clause that bans commercial endeavors on top of the already difficult-to-comply-with Affero clause. If you want to be paid, just... demand payment.[1] That's what proprietary licensing is for, and you are never going to close the "SaaS loophole" in FOSS while still remaining in the spirit and letter of FOSS. The thing about SaaS is that it wasn't invented this decade. Even back in the 80s and 90s when FOSS was novel, you had massive IBM mainframes that could be partitioned, virtualized, and rented out exactly in the same way Amazon does today. [0] GPL and weaker copylefts are tolerable because said licensing provisions only trip on distribution. Ordinary users do not need to worry about GPL compliance until they want to give someone else their code. This is a feature, not a bug. [1] Are FOSS support contracts still a thing?

didibus 5y ago

Seems a better solution would be a checksum on the license text no?

pabs3 5y ago
The most accurate license detector is ScanCode. I think it uses some sort of rolling checksum thing for detection. https://github.com/nexB/scancode-toolkit/ https://github.com/nexB/scancode-toolkit/
- pombreda 5y ago
  Hey, pabs3! Actually this is not using a rolling checksum for detection but rather a combo of language model, checksums, automatons, bitvectors, inverted indexes and multiple sequences alignment (e.g. a specialized diff). I put some docs there to explain the approach at ahttps://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/README.rst https://github.com/nexB/scancode-toolkit/blob/develop/src/li...
pombreda 5y ago
You need a bit more than checksums for this. If anything the FSF published many different versions of the "official" GPL2 texts and this would defeat checksums. See https://github.com/pombredanne/gpl-history https://github.com/pombredanne/gpl-history ... so in the general cases hashing a text does not work consistently and safely. Eventually you need a diff for a pairwise comparison, and the only difficulty is making diff fast or find ways to approximate it fast enough to avoid doing a full diff.