4 ms·

Direct link to the license and post from the ImageSharp side, as both their and the .NET Foundation's posts are worth reading: https://sixlabors.com/posts/licen

by ethbr0 4y ago

Direct link to the license and post from the ImageSharp side, as both their and the .NET Foundation's posts are worth reading: https://sixlabors.com/posts/license-changes/ https://sixlabors.com/posts/license-changes/ Tl;dr as near as I can tell: - If you are "an Open Source or Source Available consumer" or "a Non-profit organization or Registered Charity", you can use the code under Apache License 2.0. - "If your annual gross revenue is less than 1M USD then the license will continue to be granted to you under the Apache License 2.0." - "If your annual gross revenue is greater than or equal to 1M USD and you are consuming any of the libraries for use in Closed Source software as a "Direct Package Dependency" as defined in the license then you must purchase a Six Labors Commercial Use License." Also, nice to see both of them handling it professionally, instead of casting aspersions as so often happens.

blibble 4y ago
> If you are "an Open Source or Source Available consumer" or "a Non-profit organization or Registered Charity", you can use the code under Apache License 2.0. but Apache allows redistribution under the same terms? so how this supposed to work?
- int_19h 4y ago
  https://github.com/SixLabors/ImageSharp/discussions/2151#discussioncomment-2942963 https://github.com/SixLabors/ImageSharp/discussions/2151#dis... "The transitive clause is actually really important, I'll explain why. I've explicitly called out the following to ensure that the Split License is non viral. Once granted, You must reference the granted license only in all documentation. In practical terms this means that If you are granted a license, that's the one you're use, not the Split License which exists to derive the license to be granted to you. So if you're OSS, you should only be concerned about and reference the Apache 2.0 license - downstream consumers shouldn't need to care. That, on the surface makes the whole transitive/direct thing seem redundant except for the fact we have to use the Split License in NuGet packages, so if someone is looking up their supply chain then they can reference the transitive clause to determine liability (none). Can it be exploited. Yes, but as I've said elsewhere. "Evil Corp is gonna evil". They're actually more likely to simply ignore the license."
  - Dylan16807 4y ago
    Getting the Apache version from someone else because they won't give it directly to you doesn't sound like an "exploit" or "evil" to me.
    - tomnipotent 4y ago
      The transitive clause is limited to "Object" form, which excludes raw source code.
      - resoluteteeth 4y ago
        It's true that the way they have defined it in the split license, you are not using imagesharp as a "transitive package dependency" if you copy the source code from the git repository of an apache licensed open source project rather than using the object code. However, that's irrelevant because they are licensing it to the open source project under the apache license. Once the open source project has it under the apache license, you can copy it from the open source project under the apache license, because the apache license allows that, and the split license won't apply in the first place. The linked page even says "Once granted, You must reference the granted license only in all documentation," so if they have the source code in their repository it will literally just say that it's apache licensed with zero mention of the split license by the explicit instructions of the creators of imagesharp. If they say that's NOT the case, because they are imposing additional restrictions, then they aren't actually licensing it to the open source project under the apache license in the first place. Otherwise, they realize that this is a massive loophole but are still hoping that companies will just pay up. I think this is what's actually the case (and why the hoped the .net foundation would accept it), but they don't want to come out and say that explicitly because then it would defeat the point.
      - int_19h 4y ago
        It doesn't matter, because these clauses are only relevant when determining the license granted to someone who is consuming the library. If an open source project does that, the following item applies: "Works in Source or Object form are licensed to You under the Apache License, Version 2.0 if ... you are consuming the Work in for use in software licensed under an Open Source or Source Available license." So at that point the author of said open source project gets to redistribute the source of the library under AL - and only AL defines what further derived works can and cannot do with it.
- plorkyeran 4y ago
  Yeah, that seems like contradictory gibberish. If you're closed source and have revenue over 1M you just have to obtain it from someone who is allowed to use it according to the Apache 2.0 license rather than directly from MS? The license explicitly allows anyone to consume it as a transitive package dependency, so you just need to make a trivial open source library which imports it and then depend on that? They might as well just say that if you have revenue over $1M they'd appreciate if you gave them money since the license doesn't seem to actually impose any sort of legal obligation to do so.
  - modeless 4y ago
    Maybe I'll start a business reselling Apache-licensed copies of ImageSharp. $10 each. As long as I don't get more than 100k customers I'll have less than $1m revenue and I'm good! This is definitely the stupidest license I've heard of. I'm currently in the same situation, thinking about how to open source one of my projects while retaining the ability to make some money somehow, and this is something I never even considered because it's so stupid.
    - tgsovlerkhgsel 4y ago
      It isn't, because as long as the price for a direct license is reasonable, companies will pay it just to have the paperwork. SQLite is public domain, and makes money by selling "licenses" to such companies (they're called something else, but it allows the company buying it to file it in their "licenses" folder and tick a checkbox; https://www.sqlite.org/copyright.html https://www.sqlite.org/copyright.html).
      - modeless 4y ago
        That doesn't make this license not stupid. Sure, SQLite sells licenses, there's nothing wrong with that, ImageSharp is welcome to do it too! But you'll notice that SQLite doesn't have a license like this one...
        justin66 4y ago

by ethbr0 4y ago

blibble 4y ago

> If you are "an Open Source or Source Available consumer" or "a Non-profit organization or Registered Charity", you can use the code under Apache License 2.0. but Apache allows redistribution under the same terms? so how this supposed to work?

int_19h 4y ago
https://github.com/SixLabors/ImageSharp/discussions/2151#discussioncomment-2942963 https://github.com/SixLabors/ImageSharp/discussions/2151#dis... "The transitive clause is actually really important, I'll explain why. I've explicitly called out the following to ensure that the Split License is non viral. Once granted, You must reference the granted license only in all documentation. In practical terms this means that If you are granted a license, that's the one you're use, not the Split License which exists to derive the license to be granted to you. So if you're OSS, you should only be concerned about and reference the Apache 2.0 license - downstream consumers shouldn't need to care. That, on the surface makes the whole transitive/direct thing seem redundant except for the fact we have to use the Split License in NuGet packages, so if someone is looking up their supply chain then they can reference the transitive clause to determine liability (none). Can it be exploited. Yes, but as I've said elsewhere. "Evil Corp is gonna evil". They're actually more likely to simply ignore the license."
- Dylan16807 4y ago
  Getting the Apache version from someone else because they won't give it directly to you doesn't sound like an "exploit" or "evil" to me.
  - tomnipotent 4y ago
    The transitive clause is limited to "Object" form, which excludes raw source code.
    - resoluteteeth 4y ago
      It's true that the way they have defined it in the split license, you are not using imagesharp as a "transitive package dependency" if you copy the source code from the git repository of an apache licensed open source project rather than using the object code. However, that's irrelevant because they are licensing it to the open source project under the apache license. Once the open source project has it under the apache license, you can copy it from the open source project under the apache license, because the apache license allows that, and the split license won't apply in the first place. The linked page even says "Once granted, You must reference the granted license only in all documentation," so if they have the source code in their repository it will literally just say that it's apache licensed with zero mention of the split license by the explicit instructions of the creators of imagesharp. If they say that's NOT the case, because they are imposing additional restrictions, then they aren't actually licensing it to the open source project under the apache license in the first place. Otherwise, they realize that this is a massive loophole but are still hoping that companies will just pay up. I think this is what's actually the case (and why the hoped the .net foundation would accept it), but they don't want to come out and say that explicitly because then it would defeat the point.
    - int_19h 4y ago
      It doesn't matter, because these clauses are only relevant when determining the license granted to someone who is consuming the library. If an open source project does that, the following item applies: "Works in Source or Object form are licensed to You under the Apache License, Version 2.0 if ... you are consuming the Work in for use in software licensed under an Open Source or Source Available license." So at that point the author of said open source project gets to redistribute the source of the library under AL - and only AL defines what further derived works can and cannot do with it.
plorkyeran 4y ago
Yeah, that seems like contradictory gibberish. If you're closed source and have revenue over 1M you just have to obtain it from someone who is allowed to use it according to the Apache 2.0 license rather than directly from MS? The license explicitly allows anyone to consume it as a transitive package dependency, so you just need to make a trivial open source library which imports it and then depend on that? They might as well just say that if you have revenue over $1M they'd appreciate if you gave them money since the license doesn't seem to actually impose any sort of legal obligation to do so.
- modeless 4y ago
  Maybe I'll start a business reselling Apache-licensed copies of ImageSharp. $10 each. As long as I don't get more than 100k customers I'll have less than $1m revenue and I'm good! This is definitely the stupidest license I've heard of. I'm currently in the same situation, thinking about how to open source one of my projects while retaining the ability to make some money somehow, and this is something I never even considered because it's so stupid.
  - tgsovlerkhgsel 4y ago
    It isn't, because as long as the price for a direct license is reasonable, companies will pay it just to have the paperwork. SQLite is public domain, and makes money by selling "licenses" to such companies (they're called something else, but it allows the company buying it to file it in their "licenses" folder and tick a checkbox; https://www.sqlite.org/copyright.html https://www.sqlite.org/copyright.html).
    - modeless 4y ago
      That doesn't make this license not stupid. Sure, SQLite sells licenses, there's nothing wrong with that, ImageSharp is welcome to do it too! But you'll notice that SQLite doesn't have a license like this one...
      - justin66 4y ago