4 ms·

The most confusing thing about autjlib is this. > Authlib offers two licenses, one is BSD for open source projects, one is a commercial license for closed sour

by v3ss0n 3y ago

The most confusing thing about autjlib is this. > Authlib offers two licenses, one is BSD for open source projects, one is a commercial license for closed source projects.

zyx321 3y ago
Right, shouldn't it be GPL? BSD can be used in commercial products. And even if the licensing of this project holds up as the author intends: If I make an Open Source project based on this, and someone else uses that in a commercial product, it would be 100% legal according to the BSD license.
- malkarouri 3y ago
  Exactly. Should be GPL licensed, and commercial projects can always buy commercial licenses.
- w0m 3y ago
  That might be his intention; at least force an intermediary OSS app before commercial use. else-payup.
  - zyx321 3y ago
    I could create a fork that differs only in name and maybe changes one or two default settings. See also: Chromium forks that disable telemetry and nothing else.
- OkayPhysicist 3y ago
  The commercial license comes with some added functionality, and support. I suspect the "for open source projects" and "for commercial software" labels aren't meant as restrictions (i.e., "Only these kinds of projects can use this license") but rather as suggestions ("If you have this kind of project, you'll probably want to use this license"). Though as it stands, it's definitely ambiguous, which is the last thing anyone wants from their licensing agreement.
judge2020 3y ago
It's not OSS. You can only use it for open source projects for free, otherwise you have to pay $1000/yr to use it. Or $2,000 a year if your company wants to pay by invoice.
- roseway4 3y ago
  The project is clearly licensed under the BSD License. See the LICENSE file and the in-file comments below. You can't both license under the standard BSD License and carve out commercial usage. """ authlib ~~~~~~~ The ultimate Python library in building OAuth 1.0, OAuth 2.0 and OpenID Connect clients and providers. It covers from low level specification implementation to high level framework integrations. :copyright: (c) 2017 by Hsiaoming Yang. :license: BSD, see LICENSE for more details. """
  - notpushkin 3y ago
    It used to be AGPL, but they switched to BSD some time ago (and I think just forgot to change wording on the commercial license offering).
malkarouri 3y ago
How would that work? If it is used by an open source project that is BSD-licensed, and then that one was used in a closed source project, what then? GPL propagates. Presumably BSD doesn't.
- deleted 3y ago
  [deleted]
- progval 3y ago
  If the closed source project redistributes the BSD project, then it must comply with its license: Redistribution and use in source and binary forms [...] are permitted [...] provided that the following conditions are met: [...] * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. [...]
beardog 3y ago
Don't some organizations want a business relationship for one reason or another? From looking at the plans, the value is mostly in support for the commercial license, which is a pretty common approach. I think the wording is the only part that is odd, although it may be an intention nudge. Also, based on a blurb from their sponsorship page, it appears they give security patches to commercial license holders before the public. https://github.com/sponsors/lepture https://github.com/sponsors/lepture
kkirsche 3y ago
This makes it a non-starter for a lot of teams I think, in large enterprises it can be difficult to keep track of licenses like this, especially if you have situations like open core but commercial tiers and whatnot.
teraflop 3y ago
The README on GitHub says: > If your company is creating a closed source OAuth provider, it is strongly suggested that your company purchasing a commercial license. And the text in the LICENSE file is a bog-standard BSD license, which doesn't say anything about not being able to use it for commercial purposes. So it looks like they're relying on companies paying for support, or out of goodwill (or confusion), rather than because of any legal obligation.
- c4mpute 3y ago
  They are relying on holding security fixes hostage.
  - v3ss0n 3y ago
    That is scary..
- wongarsu 3y ago
  Or to avoid legal uncertainty. The bigger the company, the more willing they are to pay $1000 a year to not have to track a potential risk, no matter how small that risk is. And another $1000 for paying by invoice, so the accounting department is happy.
- 0x0000000 3y ago
  It may also be a way to make financially supporting a project easier for users in corp environments -- it can be easier to get an expense through for a $1k software license than a $100 donation to an open source project or individual author.

by v3ss0n 3y ago

The most confusing thing about autjlib is this. > Authlib offers two licenses, one is BSD for open source projects, one is a commercial license for closed source projects.

zyx321 3y ago

Right, shouldn't it be GPL? BSD can be used in commercial products. And even if the licensing of this project holds up as the author intends: If I make an Open Source project based on this, and someone else uses that in a commercial product, it would be 100% legal according to the BSD license.

malkarouri 3y ago
Exactly. Should be GPL licensed, and commercial projects can always buy commercial licenses.
w0m 3y ago
That might be his intention; at least force an intermediary OSS app before commercial use. else-payup.
- zyx321 3y ago
  I could create a fork that differs only in name and maybe changes one or two default settings. See also: Chromium forks that disable telemetry and nothing else.
OkayPhysicist 3y ago
The commercial license comes with some added functionality, and support. I suspect the "for open source projects" and "for commercial software" labels aren't meant as restrictions (i.e., "Only these kinds of projects can use this license") but rather as suggestions ("If you have this kind of project, you'll probably want to use this license"). Though as it stands, it's definitely ambiguous, which is the last thing anyone wants from their licensing agreement.

judge2020 3y ago

It's not OSS. You can only use it for open source projects for free, otherwise you have to pay $1000/yr to use it. Or $2,000 a year if your company wants to pay by invoice.

roseway4 3y ago
The project is clearly licensed under the BSD License. See the LICENSE file and the in-file comments below. You can't both license under the standard BSD License and carve out commercial usage. """ authlib ~~~~~~~ The ultimate Python library in building OAuth 1.0, OAuth 2.0 and OpenID Connect clients and providers. It covers from low level specification implementation to high level framework integrations. :copyright: (c) 2017 by Hsiaoming Yang. :license: BSD, see LICENSE for more details. """
- notpushkin 3y ago
  It used to be AGPL, but they switched to BSD some time ago (and I think just forgot to change wording on the commercial license offering).

malkarouri 3y ago

How would that work? If it is used by an open source project that is BSD-licensed, and then that one was used in a closed source project, what then? GPL propagates. Presumably BSD doesn't.

deleted 3y ago
[deleted]
progval 3y ago
If the closed source project redistributes the BSD project, then it must comply with its license: Redistribution and use in source and binary forms [...] are permitted [...] provided that the following conditions are met: [...] * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. [...]

beardog 3y ago

Don't some organizations want a business relationship for one reason or another? From looking at the plans, the value is mostly in support for the commercial license, which is a pretty common approach. I think the wording is the only part that is odd, although it may be an intention nudge. Also, based on a blurb from their sponsorship page, it appears they give security patches to commercial license holders before the public. https://github.com/sponsors/lepture https://github.com/sponsors/lepture

kkirsche 3y ago

This makes it a non-starter for a lot of teams I think, in large enterprises it can be difficult to keep track of licenses like this, especially if you have situations like open core but commercial tiers and whatnot.

teraflop 3y ago

The README on GitHub says: > If your company is creating a closed source OAuth provider, it is strongly suggested that your company purchasing a commercial license. And the text in the LICENSE file is a bog-standard BSD license, which doesn't say anything about not being able to use it for commercial purposes. So it looks like they're relying on companies paying for support, or out of goodwill (or confusion), rather than because of any legal obligation.

c4mpute 3y ago
They are relying on holding security fixes hostage.
- v3ss0n 3y ago
  That is scary..
wongarsu 3y ago
Or to avoid legal uncertainty. The bigger the company, the more willing they are to pay $1000 a year to not have to track a potential risk, no matter how small that risk is. And another $1000 for paying by invoice, so the accounting department is happy.
0x0000000 3y ago
It may also be a way to make financially supporting a project easier for users in corp environments -- it can be easier to get an expense through for a $1k software license than a $100 donation to an open source project or individual author.