3 ms·

> Why do these fixes not end up becoming available to the public? Presumably the patches are not open source, and given to the supported users under a licence

> Why do these fixes not end up becoming available to the public? Presumably the patches are not open source, and given to the supported users under a licence that restricts their distribution. The licenses the main code is available under say nothing to stop this – even if the project was covered by some GPL variant they would still be able to do this (assuming all contributors have signed over relicensing rights or similar). > But then it only takes one... That one might be taking quite a risk though. They'd be in breach of whatever agreement the updates were handed to them under, so might stop getting future updates so had better not do this (well, get caught doing it!) while they still depend on timely security updates themselves. Even if they no longer need future updates, there will be potential for a costly legal argument.

Wowfunhappy 3y ago
Ah, I see, OpenSSL is licensed under "an Apache-style license"[1], so they can distribute patches under non-OSS licenses if they so desire. I thought it was a GPL-style viral license for some reason. 1: https://www.openssl.org/ https://www.openssl.org/
- yrro 3y ago
  That applies to OpenSSL 3.0. 1.1.1 and other versions are more MIT-like, but with advertising clauses that make them incompatible with the GPL: https://www.openssl.org/source/license-openssl-ssleay.txt https://www.openssl.org/source/license-openssl-ssleay.txt https://news.ycombinator.com/item?id=13945492 https://news.ycombinator.com/item?id=13945492
- semiquaver 3y ago
  Even if OpenSSL were licensed under the GPL, nothing prevents the organization from releasing patches or separate distributions under a restrictive commercial license. They are the copyright holder. Viral open source licenses constrain _licensees_ to release derivative works under the same terms, but they can’t somehow destroy inherent ownership rights due to the copyright holder.
  - Wowfunhappy 3y ago
    Yes, but only if no one outside the organization has ever contributed code, or if everyone who did signed a CLA.
    - semiquaver 3y ago
      I was going to add that OpenSSL does in fact have a strong CLA enforcement policy, as should anyone attempting to earn money from open source software. Of course you’re right, if the actual copyright ownership is in dispute then ownership rights associated with that ownership are difficult to invoke.

Wowfunhappy 3y ago

Ah, I see, OpenSSL is licensed under "an Apache-style license"[1], so they can distribute patches under non-OSS licenses if they so desire. I thought it was a GPL-style viral license for some reason. 1: https://www.openssl.org/ https://www.openssl.org/

yrro 3y ago
That applies to OpenSSL 3.0. 1.1.1 and other versions are more MIT-like, but with advertising clauses that make them incompatible with the GPL: https://www.openssl.org/source/license-openssl-ssleay.txt https://www.openssl.org/source/license-openssl-ssleay.txt https://news.ycombinator.com/item?id=13945492 https://news.ycombinator.com/item?id=13945492
semiquaver 3y ago
Even if OpenSSL were licensed under the GPL, nothing prevents the organization from releasing patches or separate distributions under a restrictive commercial license. They are the copyright holder. Viral open source licenses constrain _licensees_ to release derivative works under the same terms, but they can’t somehow destroy inherent ownership rights due to the copyright holder.
- Wowfunhappy 3y ago
  Yes, but only if no one outside the organization has ever contributed code, or if everyone who did signed a CLA.
  - semiquaver 3y ago
    I was going to add that OpenSSL does in fact have a strong CLA enforcement policy, as should anyone attempting to earn money from open source software. Of course you’re right, if the actual copyright ownership is in dispute then ownership rights associated with that ownership are difficult to invoke.