5 ms·

So, we may need to add a "Not for use in the European Union" clause to open source licenses?

by jcadam 3y ago

uxp8u61q 3y ago
No, but you may refuse to provide paid support to EU customers if you don't want to deal with your product's cybersecurity (risk assessment, vulnerability reporting, etc).
MaxBarraclough 3y ago
I suspect such a licence would be rejected by the OSI, and by the FOSS community. Criterion 5 of the OSI's Open Source definition: [0] > No Discrimination Against Persons or Groups > The license must not discriminate against any person or group of persons. To my knowledge this hasn't been tried in a licence before. FOSS licences generally state something about accepting no liability, and this seems to work pretty well even across jurisdictional differences. Presumably the legal situation changes if the software is sold, e.g. with enterprise Linux distributions, but of course FOSS is not typically distributed on that basis. [0] https://opensource.org/osd/ https://opensource.org/osd/
- seeknotfind 3y ago
  Well, who made them the gatekeeper? OSI bought a domain, they are not open source. Regional licensing is pretty standard in general though. Especially for things under copyright. Or "No use if use implies X constraint". There are surely ways to word it that focus on how using it impacts the software, without having to mention a specific group.
  - MaxBarraclough 3y ago
    > Well, who made them the gatekeeper? OSI bought a domain, they are not open source. The broader community puts a lot of stock in the licence-approval work done by the OSI, the FSF, and the Debian project. One concrete consequence is that the Debian repositories won't accept your package. (Debian's requirements are much like those of the OSI. In practice, the 3 bodies almost always agree on whether a licence is acceptable.) Less concretely, in terms of adoption and community-building it can be really bad news for a project to be almost truly Free and Open Source.
- mminer237 3y ago
  If you wanted to satisfy the OSI for some reason, you could do something like: "This license is not granted to jurisdictions requiring external security assessments except when such external security assessments have already been performed or for the exclusive purpose of performing such assessments."
  - AnthonyMouse 3y ago
    Maybe open source licenses need some kind of general "void where prohibited" clause that specifies parts of the license which are non-negotiable and if a jurisdiction won't enforce them then nobody there can use it. This might also deter governments from passing that category of bad laws because you're going to have a lot of grumpy companies and citizens if a new law tries to void a common version of the BSD license or GPL that makes NO WARRANTIES sina qua non.

So, we may need to add a "Not for use in the European Union" clause to open source licenses?

by jcadam 3y ago

So, we may need to add a "Not for use in the European Union" clause to open source licenses?

No, but you may refuse to provide paid support to EU customers if you don't want to deal with your product's cybersecurity (risk assessment, vulnerability reporting, etc).

MaxBarraclough 3y ago

I suspect such a licence would be rejected by the OSI, and by the FOSS community. Criterion 5 of the OSI's Open Source definition: [0] > No Discrimination Against Persons or Groups > The license must not discriminate against any person or group of persons. To my knowledge this hasn't been tried in a licence before. FOSS licences generally state something about accepting no liability, and this seems to work pretty well even across jurisdictional differences. Presumably the legal situation changes if the software is sold, e.g. with enterprise Linux distributions, but of course FOSS is not typically distributed on that basis. [0] https://opensource.org/osd/ https://opensource.org/osd/

seeknotfind 3y ago
Well, who made them the gatekeeper? OSI bought a domain, they are not open source. Regional licensing is pretty standard in general though. Especially for things under copyright. Or "No use if use implies X constraint". There are surely ways to word it that focus on how using it impacts the software, without having to mention a specific group.
- MaxBarraclough 3y ago
  > Well, who made them the gatekeeper? OSI bought a domain, they are not open source. The broader community puts a lot of stock in the licence-approval work done by the OSI, the FSF, and the Debian project. One concrete consequence is that the Debian repositories won't accept your package. (Debian's requirements are much like those of the OSI. In practice, the 3 bodies almost always agree on whether a licence is acceptable.) Less concretely, in terms of adoption and community-building it can be really bad news for a project to be almost truly Free and Open Source.
mminer237 3y ago
If you wanted to satisfy the OSI for some reason, you could do something like: "This license is not granted to jurisdictions requiring external security assessments except when such external security assessments have already been performed or for the exclusive purpose of performing such assessments."
- AnthonyMouse 3y ago
  Maybe open source licenses need some kind of general "void where prohibited" clause that specifies parts of the license which are non-negotiable and if a jurisdiction won't enforce them then nobody there can use it. This might also deter governments from passing that category of bad laws because you're going to have a lot of grumpy companies and citizens if a new law tries to void a common version of the BSD license or GPL that makes NO WARRANTIES sina qua non.