10 ms·

Please stop inventing new software licences (2020)

133 points by edent 2y ago

fergie 2y ago
Its almost as if some companies coughElasticcough want the upsides of being open source without having to, you know, actually be open source.
- llm_trw 2y ago
  Being open source is not a great thing to aspire to. After all, it's just free software for people who don't want to give their users the source code.
  - klez 2y ago
    What definition of "Open Source" are you talking about that allows to not give your users the source code?
    - actionfromafar 2y ago
      It's a reference to that GPL protects user access to source. (Sour grapes that the term Open Source encompasses Free Software as defined by FSF, I'd say.)
      - klez 2y ago
        The second point of the Open Source Definition is literally: > 2. Source Code > The program must include source code, and must allow distribution in source code as well as compiled form So I'm still not sure what they're talking about. Unless they're talking about MIT, BSD, Apache, etc. licenses, that allow third parties to redistribute compiled binaries without having to provide source code, in which case the point is still weird, since they are still considered Free Software licenses by the FSF.
        actionfromafar 2y ago
        The last paragraph is exactly what I mean. Yes, it’s weird or at least not articulated well. Even FSF believes MIT is a free license, albeit in their view, an inferior one.
        Suzuran 2y ago
        I think they are referring to the MIT license and similar, but not wording it well. I can take something that is MIT-licensed and incorporate it into a closed-source commercial product, and I am not forced (as I would be with the GPL) to open-source my entire commercial product. They feel this is not truly "Open Source" and it is wrong to accept licenses which allow this behavior as "Open Source".
    - llm_trw 2y ago
      The MIT license for one.
- echelon 2y ago
  You should be able to be open source to your customers, but closed source to hyperscalers like Amazon with 1000x your scale and budget.
  - bruce511 2y ago
    You can do that. There are lots of models. Just don't call it Open Source. That term has a meaning, and you may not like the meaning, but that doesn't mean you change the term. It means you publish under a different license.
    - mickael-kerjean 2y ago
      Working on a OSS product myself, there's a much darker side I've seen played out many times by many companies including well known ones like Deutsche Bank and Royal Bank of Canada where they abuse your time and knowledge by making you think they will purchase support from you but end up never doing it.
    - mschuster91 2y ago
      The problem is, the assumption under which the "old" OSS models operate no longer hold true - primarily, that the actors (which used to be universities) play fair and contribute back to the ecosystem, and there is no reckless exploitation by single actors that kill off other actors who do contribute back. I do love open source software, I contribute to open source software in all kinds of ways from filing bug tickets over develop workarounding hacks to legitimate enhancements. I have no problem with small and medium businesses can profit off of that. But I - and many others - have a serious problems with (especially) the large hyperscalers doing just about nothing to contribute back. We need licensing models that prevent hyperscalers squeezing out the rest of the ecosystem like fucking lemons and keeping all the revenue.
      - aleph_minus_one 2y ago
        > But I - and many others - have a serious problems with (especially) the large hyperscalers doing just about nothing to contribute back. We need licensing models that prevent hyperscalers squeezing out the rest of the ecosystem like fucking lemons and keeping all the revenue. If you have a problem with this, license the product, for example, under GNU Affero General Public License (AGPL).
- 2Gkashmiri 2y ago
  I personally see "OSI approved license is only open source license" argument as childish. Free software and free license OTOH, is much wider and is beyond the triviality of the fact whether OSI has approved a license or not. That said, "free software" movement what that is, is elastic sspl a free software ideology compatible or not?
  - johannes1234321 2y ago
    What OSI mostly does in that space is giving a definition for "open source" https://opensource.org/osd https://opensource.org/osd Having a definitions for a term is good, as it makes sure thee is a common reference in usage. If everybody uses a different definition it hinders discussion. If that definition doesn't serve your needs better use a different term (there are more or less related other terms like free software, shared source, libre software etc) Licenses more or less automatically fall under that definition or not (yeah, yeah, there is a process by OSI for certification, but that is relatively close to the definition)
    - frumper 2y ago
      I've always read the term open source as the source is available for me to read so I know what I'm running. Beyond that if I'm an adventurous sort then I could try and compile it to run for my personal usage. Windows 95 was closed source because we couldn't read the source code, not because we couldn't contribute or fork it.
  - chrisandchris 2y ago
    Is it? It's about knowing what you're getting into and what (and specifically what not) the provider of the source expects you to do. If you take a well-known license, people know what they get and, imho, maybe some larger provider will pick up your software and let your business grow. If you do a custom license, legal may say no and people avoid your software. I also think one shouldn't mix free software/free license and open source. Elastic is IMHO compatible to a free software, but it's not really open source (just source available).
- martypitt 2y ago
  FWIW, Elastic is now open again (AGPL) - as of about two weeks ago. https://www.elastic.co/blog/elasticsearch-is-open-source-again https://www.elastic.co/blog/elasticsearch-is-open-source-aga...
  - philipwhiuk 2y ago
    And that blog utterly fails to make me convinced they truly like being open source.
lifthrasiir 2y ago
(2020). Also the very existence of 100+ OSI approved licenses means that there are some reasons (or incentives) to invent new software licenses after all.
- michaelt 2y ago
  Does it mean that? Or does it mean corporate legal teams feel the same impulses that have lead programmers to produce 100+ javascript frameworks?
  - lifthrasiir 2y ago
    Making JS frameworks is much cheaper than doing necessary legal works to draft a new license. (Not all OSI-approved licenses are written by lawyers, but many if not most of them should have been eventually reviewed by lawyers at least once.)
    - usrusr 2y ago
      Much cheaper for the company footing the bill, and much less worthwhile for the expert convincing the company that it's a good idea to spend the money.
    - Propelloni 2y ago
      > Making JS frameworks is much cheaper than doing necessary legal works to draft a new license. Serious question: What makes you think that? In my world, a legal professional whips up a license in a few days, from there you iterate. It's pretty much like software development and neither more or less expensive. What I see is that legal work items often have more idle time, because we usually have less legal professionals than software developers and we often need to get feedback from people who are not readily available, thus potentially increasing cost of delay, but that's all I can think of. I'm certain I'm missing something. What is it?
      - lifthrasiir 2y ago
        Simple: most if not all JS frameworks are not profitable, so they are almost always driven by passion. (It will be much more expensive if you have to pay someone to write a JS framework for some weird reason.) That alone explains a proliferation of JS frameworks as the original comment questioned, while the number of different software licenses wouldn't be explained as such.
bruce511 2y ago
I'm not sure the title is the correct response. As in "stop making software licenses" is not the problem. Clearly any business can license their software any way they like. What caused the poster some confusion is that it was marketed as an "open source" product. Once he determined it was not an OSI approved license then that should be the end of it. It's not Open Source. period. By all means call them out on that - lots of people and companies are not licensing experts, and need guidance. I've helped people with this in the past and encouraged them to change to actual Open Source licenses that are compatible with their goals, and the goals of their community. If anything the real headline should be "stop calling your product open source when it doesn't have an open source license". [To be clear - I produce commercial software under not-open-source licenses. I've got no objection to folk doing that. I even ship the source with the product, and accept contributions back. But I don't call it "open source" because it's not "Open Source". It's something, sure, but it's not Open Source.]
- leni536 2y ago
  I think the author would have been fine with a "source available" license that allowed them to contribute back the usual way (fork + PR).
- alkonaut 2y ago
  Yeah The Reference Source License is a "source available" license. It's not "open source" in the OSI sense that it can be contributed to or used for any other purpose. For a security product, "source available" is MUCH better than nothing at all (closed, proprietary). Not sure why these people chose the Microsoft reference license for their product, but I guess if you are in a hurry and you need an example of a source available license then I'd also consider just grabbing one from a megacorp that probably had armies of lawyers go over it.
- hnlmorg 2y ago
  I think your take is a much more levelheaded view of events than the authors. I completely agree with you that we shouldn’t be restricting how people choose to license their code. And agree that the real issue is the marketing: ie people calling something “open source” when it’s actually “source available to read”. I see quite a few organisations play this game, like Obsidian. I’ve seen highly skilled and intelligent engineers fall for the trap of calling Obsidian open source because they can inspect the code of the Electon app; forgetting that doesn’t actually grant them a license to do anything with the code. Like yourself, I have no qualms if an organisation wants to build proprietary / for profit stuff. I understand that means they might not even want to share their code. But what I do object to is when those organisations then try to gain some open source “street cred” for something that is proprietary.
ProxCoques 2y ago
AFAIKT, even the "Popular/Strong Community" list on https://opensource.org/license https://opensource.org/license all just essentially say you don't have pay for the source code, can't complain to the authors if it goes wrong, and then some variations around not treating it as your own code. (BTW their filters work funny)
- lifthrasiir 2y ago
  FYI: Update filters and refresh the page to get the correct list. (Yes it is wonky...)
rellfy 2y ago
There's nothing wrong with releasing software under a license that allows contributions but disallows commercial use, which is what Cyph was attempting to do: > We're a small startup with a significant amount of time and money invested into the development of Cyph. We recognize the need for anyone to be able to review the code and verify our production build against it from a security perspective, but at the same time it would be problematic if an unrelated third party could just stand up their own instance of Cyph and directly compete with us at this stage. We would be much more inclined to fully open source Cyph at a later stage of the business. I disagree with the philosophy of forbidding any contributions just because they are not fully open-source for commercial purposes. This seems like a very common scenario for software that is almost "open source" except for not allowing commercial deployments. I would be surprised if there is no existing licence to cover this use case, but it will not be fully open source of course. Which again doesn't mean that all contributions need to be forbidden.
- bruce511 2y ago
  I'm not sure what "forbidding" you ate referring to? Who forbids? Who feels bound by such forbidding? Not open source is more than welcome to accept contributions and people are free to contribute to anything they like. There's also no such thing as "fully open source". It's either open source or it's not. There are lots of business models. Open source is one very specific model. Please don't call it Ooen Source if it's not that.
  - lifthrasiir 2y ago
    That's unfortunately a very narrow sense. In fact, the most common definition of open source implies open governance because of the wording. The exact definition will vary depending on exact authorities (OSI vs. FSF), governance transparency, relationship with patents, treatment of non-software contents and many others. This ambiguity is why I never say "open source" alone, at the very least I say F/OSS to be clear. Maybe I should start saying something more soon.
    - bruce511 2y ago
dataflow 2y ago
> The wording still precludes me forking this repo on GitHub. AFAIK that's irrelevant per GitHub's TOS, which users agree to: By setting your repositories to be viewed publicly, you agree to allow others to view and "fork" your repositories (this means that others may make their own copies of Content from your repositories in repositories they control). If you set your pages and repositories to be viewed publicly, you grant each User of GitHub a nonexclusive, worldwide license to use, display, and perform Your Content through the GitHub Service and to reproduce Your Content solely on GitHub as permitted through GitHub's functionality (for example, through forking). AIUI you therefore always have the right to fork something on GitHub. https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#5-license-grant-to-other-users https://docs.github.com/en/site-policy/github-terms/github-t...
- actionfromafar 2y ago
  Cave-at. If someone shares something on github which they do not have the copyright to, nor license for, then that can impossibly be okay to fork on Github.
  - spookie 2y ago
    I've seen people forking Unreal Engine on GitHub without any restrictions for public view. Makes one think about this kind of thing.
  - Digit-Al 2y ago
    You are correct. Github's license terms are a hedge against that sort of thing. They are basically saying "the person making this source available is granting the license to d these particular things" - therefore, the user making the source available takes on the responsibility for making sure they actually have the authority to make this source available. If they do not have this authority then they are the ones that will be sued - not Github nor any users who cloned the code.
- LegionMammal978 2y ago
  Though beware: you do have license to fork it on GitHub, but you don't necessarily have license to clone this fork locally. (Then again, that makes me think: does that mean you could use a modified copy however you want, as long as you only do it over GitHub CI?)
sph 2y ago
I wish there were more standard open-but-not-open-source licenses available. Or open-but-only-for-personal-use or open-but-cannot-distribute. Something standard and vetted enough that projects like these could adopt instead of having to write themselves.
- hnlmorg 2y ago
  They didn’t really write this license themselves. It was Microsoft license that they slightly adapted after someone complained they couldn’t contribute. The real issue here is that the product wasn’t open source despite being advertised as such. The licensed they used, Microsoft Reference Source License, isn’t an open source license. It’s more accurately described as “source available”. Ie you can view the source but you’re not really allowed to use it for anything.
- ksec 2y ago
  >I wish there were more standard open-but-not-open-source licenses available. Or open-but-only-for-personal-use or open-but-cannot-distribute. Source Available. Something like Unreal or ONCE.
  - lifthrasiir 2y ago
    I think that label is also already taken, because "source availability" doesn't imply an ability to rebuild it from the source or even make a suggestion. I guess there should be some compositional keywords for different aspects of non-F/OSS but not completely proprietary licenses. Source available, artifact buildable, artifact distributable under some conditions, etc.
    - ksec 2y ago
      Or Shared Source ?
- jjmarr 2y ago
  Creative Commons has standardized non-commercial and no-derivatives licences. https://creativecommons.org/share-your-work/cclicenses/ https://creativecommons.org/share-your-work/cclicenses/ This covers some of the use cases you describe.
syockit 2y ago
I checked the Wayback Machine to see how the about page for cyph looked like [1], and it said "open source", not "Open Source". So, I don't get what the beef is about. [1] https://web.archive.org/web/20200517031524/https://www.cyph.com/about https://web.archive.org/web/20200517031524/https://www.cyph....
mnky9800n 2y ago
You know what I hate about these days is this is a blog I enjoyed but then I got to the post about hacktoberfest and it occurred to me, what if this was all written to advertise hacktoberfest and the author got paid in some way for this? What bothers me about it isn't whether or not it happened, it's that I questioned the authenticity of the author simply because he posted a link and what if he did so because he was paid to do so as opposed to simply being interested. Which is exactly the internet I want to live in. One where people write interesting things and share links to other interesting things.
- edent 2y ago
  I can exclusively reveal that I have received several t-shirts from Hacktoberfest. Indeed, I'm wearing one right now. My laptop also has many of their stickers. They didn't pay me to write this blog though. Of course, you have no way of knowing if that's true. Just as I have no way of knowing if you were paid by a rival to spread discord.
  - mnky9800n 2y ago
    My point isn't that this happened. I don't think anyone did anything other than write and read a blog post. It's that we exist in a world where it could and therefore the thought that I might need to question the authenticity of things is ever present which I find troublesome.
    - edent 2y ago
      This isn't a modern problem. Shakespeare was paid handsomely by the Crown - hence his somewhat hagiographic biographies. You will never find writing which is free from bias and influence. You can either make peace with that and find ways to mitigate against it, or you can remain in distress.
      - mnky9800n 2y ago
        I choose peace.
webprofusion 2y ago
Agree it's complex, and when attempting to solve a particular problem you end up with yet another license every time. What businesses in particular want is a "Yes, you can read the code and yes you help if you want to, but you can't use the code to make your own product" source-available license (because they have devs to pay, and being able to keep doing that is the first thing they need to protect). I think such licenses do sort of exist but they're fragmented. The root of this particular argument seems to the definition of Open Source meaning unconstrained use of source code, instead of source-available.
jusomg 2y ago
I will only add that non-standard licenses also hurt adoption, specifically in medium/big businesses/enterprises. Most organizations understand common open source licenses and there's usually a blank statement that allows teams to use GPL/MIT/whatever-licensed software. Anything outside that subset of licenses (even if they're permissive, open source or whatnot) requires a legal review and a lot of people won't go through the pain of that process just to use a library/service/app. It's easier to just choose something else.
- Doctor_Fegg 2y ago
  > specifically in medium/big businesses/enterprises. This is a feature, not a bug.
  - School-Cotton 2y ago
    If you don’t want big companies to use your code just make it GPL, which is usually banned.
- draw_down 2y ago
  [dead]
- School-Cotton 2y ago
  > there's usually a blank statement that allows teams to use GPL/MIT/whatever-licensed software. In my experience: MIT yes, GPL no.
rambambram 2y ago
Please fit in the exact little box that I have of you in my mind and stop deciding for yourself what you want to do with your stuff. I beg your pardon!?
anilakar 2y ago
In other words, please stop pretending you're open source.
surfingdino 2y ago
Microsoft dropping "open source" licenses into the Open Source ecosystem? Why am I not surprised? The ghosts of their "Linux is Cancer" campaign just cannot die.
phkahler 2y ago
Going one level up from the title one should want to avoid OSI licenses. Their original purpose was to approve new licenses. MIT, BSD, and the GPLs already existed, so OSI "approving" more was IMHO not very helpful. Anyone not satisfied with those options was usually trying to add some level of control. Even with a well written new license you cause developers problems wondering about "license compatibility" when they try to combine code under different licenses - a practice that is really useful but often overlooked by license creators.
- JimDabell 2y ago
  All new licenses that apply for OSI certification have to fill a gap that existing licenses don’t cover: https://opensource.org/licenses/review-process https://opensource.org/licenses/review-process
  - firesteelrain 2y ago
    I haven’t looked but taking what the author is saying at face value - there are 100 unique gaps requiring 100 new licenses?!
    - JimDabell 2y ago
      No. The author pointed out there are over 100 OSI licenses, not over 100 new OSI licenses. Many of those are pre-existing licenses, superseded licenses, etc.
      - firesteelrain 2y ago
        You said “ new licenses that apply for OSI certification have to fill a gap that existing licenses don’t cover” That was my point - there are 100+ gaps?
        JimDabell 2y ago
        No. I’m not sure what you aren’t understanding? There are 100+ total, not 100+ new.
deleted 2y ago
[deleted]
LadyCailin 2y ago
I’ve created a non-toy programming language, and at some point I intend on creating a package manager for it. The official repository for packages will require all code to be open source, and I’ve already decided to be opinionated about what that means. I’ll pick a handful of well known, and actual open source licenses (MIT, GPL, BSD, Apache Commons, etc) and require people that want to upload to this repo to select their license from the finite list. If they want to use another license, they are still free to do so, but they’ll have to stand up their own repository, and get users to add the repo to their sources list. There’s just too many licenses, each with different (sometimes incompatible) requirements, so one advantage to being so opinionated is that you can add automatic checks to ensure you’re in compliance. For instance, if your library is MIT (only), you can’t use GPL dependencies. Most people probably don’t know this, so having tooling that helps enforce this ought to make things more compliant overall.
j16sdiz 2y ago
TFA: > What does "intended" mean here? I don't understand what problem the author have. We have lots of law and case based on intention.
- edent 2y ago
  Which ones specifically?
  - jasonlotito 2y ago
    Easier to ask which ones do not. Intent is all over the place in law. Seriously, I'm normally one for supporting providing citation, but just look up criminal intent, or intent in law, especially in the context of the US. The most well known intent based law is manslaughter. You killed someone but didn't intend to, as opposed to murder, where you did intend to. But intent is all over law. It's similar to motive in that both are dependent on what the person is thinking. Intent being why they are buying the knife (to cut a steak), and motive being why they are using the knife (they are hungry).
eddiejaoude 2y ago
So many companies try to scam the community, by calling themselves open source but many are not. Great to see you checked and called them out. We should support and reward the real companies that are actually open source, and who care about the community and transparency!
sneak 2y ago
This article could be summed up with “many projects are engaging in open source/free software cosplay”. There are lots of projects that claim to be open source, and either are lying/don’t have free software licenses (CapRover, for example), or don’t work like an open source project is expected to (VS Code, Chromium), denying patches being integrated even if they fit project standards and provide benefit to users.
b_shulha 2y ago
This is why I like Fair Source License. It protects the company's IP but gives a community legal ways to contribute & use software for their needs. https://fsl.software https://fsl.software
- michaelmior 2y ago
  The link you gave is to the Functional Source License. Did you mean to use a different link? If you were referring to the Functional Source License, it's worth noting that it is explicitly not open source.
  - b_shulha 2y ago
    Right, that's a good addition. Thanks. However, it solves problems the author mentions in his article: you can freely contribute and use the software as you wish, just don't create a competitive company using the recent versions of the sources. And in 2 years the code becomes true OSS - either MIT or Apache 2.0 (or anything else you want - the FSL itself is pretty short so you can easily adjust it to your needs without spending hours on lawyer consultations). BTW, the FSL is driven by Sentry, and they have created an org to cover the fair usage licensing: https://fair.io https://fair.io (that's why I have mistyped the FSL name in the original comment).
    - b_shulha 2y ago
      This is the core part of FSL-1.1-Apache-2.0. For MIT it is the same, just the "Grant of Future License" paragraph mentions the corresponding license. --- License Grant Subject to your compliance with this License Grant and the Patents, Redistribution and Trademark clauses below, we hereby grant you the right to use, copy, modify, create derivative works, publicly perform, publicly display and redistribute the Software for any Permitted Purpose identified below. Permitted Purpose A Permitted Purpose is any purpose other than a Competing Use. A Competing Use means making the Software available to others in a commercial product or service that: substitutes for the Software; substitutes for any other product or service we offer using the Software that exists as of the date we make the Software available; or offers the same or substantially similar functionality as the Software. Permitted Purposes specifically include using the Software: for your internal use and access; for non-commercial education; for non-commercial research; and in connection with professional services that you provide to a licensee using the Software in accordance with these Terms and Conditions.
ordu 2y ago
Mostly unrelated to the article, but the title stirred up memories. ~20 years ago I stumbled across the "Ё" license, that granted you all rights you can dream of with one condition, you must use the letter "ё" in its right place all the time. It is a Russian story, with some people loving "ё" and whining that outside of children books you can't find it, and other people trolling the first group by arguing that "ё" was a stupid addition from the very beginning, and even more stupid now. Sadly I cannot google the text of the license now.
- School-Cotton 2y ago
  How often is ё really used by native speakers?
  - ordu 2y ago
    I cannot say numbers, because I don't watch for them... So I took a blog I read regularly, and counted top level comments to some post, I got 10 people used it, 4 didn't use, and 8 didn't use words with "ё", so I cannot say, do they use "ё" or not. So, it seems people use it pretty often. But books "for adults" for some reason use "ё" only when replacing it with "е" leads to ambiguity.
deleted 2y ago
[deleted]
pchangr 2y ago
Reminds me of the old “Standards” xkcd https://xkcd.com/927/ https://xkcd.com/927/
notfed 2y ago
Also worth mentioning that, in the time since this article was written, Signal Messenger is now post-quantum secure [1], and has always been free and actually open source. [1] https://signal.org/blog/pqxdh/ https://signal.org/blog/pqxdh/
buu700 2y ago
Cyph cofounder here. To be clear, the primary purpose of the license change was to allow users to validate reproducible builds of our code against the production version of Cyph without fear of technically violating the Ms-RSL license. OP's feedback was appreciated, but mostly unrelated to the license change except insofar as it reminded me to touch base with our counsel on the topic. If there's an alternative license to the Cyph-RSL that meets our needs, I'd be happy to consider it, but I don't see any particular problem with the fact that we authored our own.
mihaic 2y ago
Almost all of the existing licenses were designed many years ago, before LLMs and enterprise cloud abused the open source model. Only half jokingly, I wanted a couple months ago to change the license of a Javascript project I made to allow anyone to do anything with it, except train LLMs on it [1]. I couldn't find anything, so I cobbled together something which I'm sure is not in proper legalize. What were my options otherwise? [1] https://github.com/mciucu/stemjs/blob/master/LICENSE https://github.com/mciucu/stemjs/blob/master/LICENSE
- majewsky 2y ago
  Not a lawyer, so take what I say with a grain of salt, but I expect this license to be unenforceable because the statement in paragraph 1 contradicts the very broad grant in paragraph 2.

133 points by edent 2y ago

Its almost as if some companies coughElasticcough want the upsides of being open source without having to, you know, actually be open source.

llm_trw 2y ago
Being open source is not a great thing to aspire to. After all, it's just free software for people who don't want to give their users the source code.
- klez 2y ago
  What definition of "Open Source" are you talking about that allows to not give your users the source code?
  - actionfromafar 2y ago
    It's a reference to that GPL protects user access to source. (Sour grapes that the term Open Source encompasses Free Software as defined by FSF, I'd say.)
    - klez 2y ago
      The second point of the Open Source Definition is literally: > 2. Source Code > The program must include source code, and must allow distribution in source code as well as compiled form So I'm still not sure what they're talking about. Unless they're talking about MIT, BSD, Apache, etc. licenses, that allow third parties to redistribute compiled binaries without having to provide source code, in which case the point is still weird, since they are still considered Free Software licenses by the FSF.
      - actionfromafar 2y ago
        The last paragraph is exactly what I mean. Yes, it’s weird or at least not articulated well. Even FSF believes MIT is a free license, albeit in their view, an inferior one.
      - Suzuran 2y ago
        I think they are referring to the MIT license and similar, but not wording it well. I can take something that is MIT-licensed and incorporate it into a closed-source commercial product, and I am not forced (as I would be with the GPL) to open-source my entire commercial product. They feel this is not truly "Open Source" and it is wrong to accept licenses which allow this behavior as "Open Source".
  - llm_trw 2y ago
    The MIT license for one.
echelon 2y ago
You should be able to be open source to your customers, but closed source to hyperscalers like Amazon with 1000x your scale and budget.
- bruce511 2y ago
  You can do that. There are lots of models. Just don't call it Open Source. That term has a meaning, and you may not like the meaning, but that doesn't mean you change the term. It means you publish under a different license.
  - mickael-kerjean 2y ago
    Working on a OSS product myself, there's a much darker side I've seen played out many times by many companies including well known ones like Deutsche Bank and Royal Bank of Canada where they abuse your time and knowledge by making you think they will purchase support from you but end up never doing it.
  - mschuster91 2y ago
    The problem is, the assumption under which the "old" OSS models operate no longer hold true - primarily, that the actors (which used to be universities) play fair and contribute back to the ecosystem, and there is no reckless exploitation by single actors that kill off other actors who do contribute back. I do love open source software, I contribute to open source software in all kinds of ways from filing bug tickets over develop workarounding hacks to legitimate enhancements. I have no problem with small and medium businesses can profit off of that. But I - and many others - have a serious problems with (especially) the large hyperscalers doing just about nothing to contribute back. We need licensing models that prevent hyperscalers squeezing out the rest of the ecosystem like fucking lemons and keeping all the revenue.
    - aleph_minus_one 2y ago
      > But I - and many others - have a serious problems with (especially) the large hyperscalers doing just about nothing to contribute back. We need licensing models that prevent hyperscalers squeezing out the rest of the ecosystem like fucking lemons and keeping all the revenue. If you have a problem with this, license the product, for example, under GNU Affero General Public License (AGPL).
2Gkashmiri 2y ago
I personally see "OSI approved license is only open source license" argument as childish. Free software and free license OTOH, is much wider and is beyond the triviality of the fact whether OSI has approved a license or not. That said, "free software" movement what that is, is elastic sspl a free software ideology compatible or not?
- johannes1234321 2y ago
  What OSI mostly does in that space is giving a definition for "open source" https://opensource.org/osd https://opensource.org/osd Having a definitions for a term is good, as it makes sure thee is a common reference in usage. If everybody uses a different definition it hinders discussion. If that definition doesn't serve your needs better use a different term (there are more or less related other terms like free software, shared source, libre software etc) Licenses more or less automatically fall under that definition or not (yeah, yeah, there is a process by OSI for certification, but that is relatively close to the definition)
  - frumper 2y ago
    I've always read the term open source as the source is available for me to read so I know what I'm running. Beyond that if I'm an adventurous sort then I could try and compile it to run for my personal usage. Windows 95 was closed source because we couldn't read the source code, not because we couldn't contribute or fork it.
- chrisandchris 2y ago
  Is it? It's about knowing what you're getting into and what (and specifically what not) the provider of the source expects you to do. If you take a well-known license, people know what they get and, imho, maybe some larger provider will pick up your software and let your business grow. If you do a custom license, legal may say no and people avoid your software. I also think one shouldn't mix free software/free license and open source. Elastic is IMHO compatible to a free software, but it's not really open source (just source available).
martypitt 2y ago
FWIW, Elastic is now open again (AGPL) - as of about two weeks ago. https://www.elastic.co/blog/elasticsearch-is-open-source-again https://www.elastic.co/blog/elasticsearch-is-open-source-aga...
- philipwhiuk 2y ago
  And that blog utterly fails to make me convinced they truly like being open source.

lifthrasiir 2y ago

(2020). Also the very existence of 100+ OSI approved licenses means that there are some reasons (or incentives) to invent new software licenses after all.

michaelt 2y ago
Does it mean that? Or does it mean corporate legal teams feel the same impulses that have lead programmers to produce 100+ javascript frameworks?
- lifthrasiir 2y ago
  Making JS frameworks is much cheaper than doing necessary legal works to draft a new license. (Not all OSI-approved licenses are written by lawyers, but many if not most of them should have been eventually reviewed by lawyers at least once.)
  - usrusr 2y ago
    Much cheaper for the company footing the bill, and much less worthwhile for the expert convincing the company that it's a good idea to spend the money.
  - Propelloni 2y ago
    > Making JS frameworks is much cheaper than doing necessary legal works to draft a new license. Serious question: What makes you think that? In my world, a legal professional whips up a license in a few days, from there you iterate. It's pretty much like software development and neither more or less expensive. What I see is that legal work items often have more idle time, because we usually have less legal professionals than software developers and we often need to get feedback from people who are not readily available, thus potentially increasing cost of delay, but that's all I can think of. I'm certain I'm missing something. What is it?
    - lifthrasiir 2y ago
      Simple: most if not all JS frameworks are not profitable, so they are almost always driven by passion. (It will be much more expensive if you have to pay someone to write a JS framework for some weird reason.) That alone explains a proliferation of JS frameworks as the original comment questioned, while the number of different software licenses wouldn't be explained as such.

bruce511 2y ago

I'm not sure the title is the correct response. As in "stop making software licenses" is not the problem. Clearly any business can license their software any way they like. What caused the poster some confusion is that it was marketed as an "open source" product. Once he determined it was not an OSI approved license then that should be the end of it. It's not Open Source. period. By all means call them out on that - lots of people and companies are not licensing experts, and need guidance. I've helped people with this in the past and encouraged them to change to actual Open Source licenses that are compatible with their goals, and the goals of their community. If anything the real headline should be "stop calling your product open source when it doesn't have an open source license". [To be clear - I produce commercial software under not-open-source licenses. I've got no objection to folk doing that. I even ship the source with the product, and accept contributions back. But I don't call it "open source" because it's not "Open Source". It's something, sure, but it's not Open Source.]

leni536 2y ago
I think the author would have been fine with a "source available" license that allowed them to contribute back the usual way (fork + PR).
alkonaut 2y ago
Yeah The Reference Source License is a "source available" license. It's not "open source" in the OSI sense that it can be contributed to or used for any other purpose. For a security product, "source available" is MUCH better than nothing at all (closed, proprietary). Not sure why these people chose the Microsoft reference license for their product, but I guess if you are in a hurry and you need an example of a source available license then I'd also consider just grabbing one from a megacorp that probably had armies of lawyers go over it.
hnlmorg 2y ago
I think your take is a much more levelheaded view of events than the authors. I completely agree with you that we shouldn’t be restricting how people choose to license their code. And agree that the real issue is the marketing: ie people calling something “open source” when it’s actually “source available to read”. I see quite a few organisations play this game, like Obsidian. I’ve seen highly skilled and intelligent engineers fall for the trap of calling Obsidian open source because they can inspect the code of the Electon app; forgetting that doesn’t actually grant them a license to do anything with the code. Like yourself, I have no qualms if an organisation wants to build proprietary / for profit stuff. I understand that means they might not even want to share their code. But what I do object to is when those organisations then try to gain some open source “street cred” for something that is proprietary.

ProxCoques 2y ago

AFAIKT, even the "Popular/Strong Community" list on https://opensource.org/license https://opensource.org/license all just essentially say you don't have pay for the source code, can't complain to the authors if it goes wrong, and then some variations around not treating it as your own code. (BTW their filters work funny)

lifthrasiir 2y ago
FYI: Update filters and refresh the page to get the correct list. (Yes it is wonky...)

rellfy 2y ago

There's nothing wrong with releasing software under a license that allows contributions but disallows commercial use, which is what Cyph was attempting to do: > We're a small startup with a significant amount of time and money invested into the development of Cyph. We recognize the need for anyone to be able to review the code and verify our production build against it from a security perspective, but at the same time it would be problematic if an unrelated third party could just stand up their own instance of Cyph and directly compete with us at this stage. We would be much more inclined to fully open source Cyph at a later stage of the business. I disagree with the philosophy of forbidding any contributions just because they are not fully open-source for commercial purposes. This seems like a very common scenario for software that is almost "open source" except for not allowing commercial deployments. I would be surprised if there is no existing licence to cover this use case, but it will not be fully open source of course. Which again doesn't mean that all contributions need to be forbidden.

bruce511 2y ago
I'm not sure what "forbidding" you ate referring to? Who forbids? Who feels bound by such forbidding? Not open source is more than welcome to accept contributions and people are free to contribute to anything they like. There's also no such thing as "fully open source". It's either open source or it's not. There are lots of business models. Open source is one very specific model. Please don't call it Ooen Source if it's not that.
- lifthrasiir 2y ago
  That's unfortunately a very narrow sense. In fact, the most common definition of open source implies open governance because of the wording. The exact definition will vary depending on exact authorities (OSI vs. FSF), governance transparency, relationship with patents, treatment of non-software contents and many others. This ambiguity is why I never say "open source" alone, at the very least I say F/OSS to be clear. Maybe I should start saying something more soon.
  - bruce511 2y ago

dataflow 2y ago

> The wording still precludes me forking this repo on GitHub. AFAIK that's irrelevant per GitHub's TOS, which users agree to: By setting your repositories to be viewed publicly, you agree to allow others to view and "fork" your repositories (this means that others may make their own copies of Content from your repositories in repositories they control). If you set your pages and repositories to be viewed publicly, you grant each User of GitHub a nonexclusive, worldwide license to use, display, and perform Your Content through the GitHub Service and to reproduce Your Content solely on GitHub as permitted through GitHub's functionality (for example, through forking). AIUI you therefore always have the right to fork something on GitHub. https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#5-license-grant-to-other-users https://docs.github.com/en/site-policy/github-terms/github-t...

actionfromafar 2y ago
Cave-at. If someone shares something on github which they do not have the copyright to, nor license for, then that can impossibly be okay to fork on Github.
- spookie 2y ago
  I've seen people forking Unreal Engine on GitHub without any restrictions for public view. Makes one think about this kind of thing.
- Digit-Al 2y ago
  You are correct. Github's license terms are a hedge against that sort of thing. They are basically saying "the person making this source available is granting the license to d these particular things" - therefore, the user making the source available takes on the responsibility for making sure they actually have the authority to make this source available. If they do not have this authority then they are the ones that will be sued - not Github nor any users who cloned the code.
LegionMammal978 2y ago
Though beware: you do have license to fork it on GitHub, but you don't necessarily have license to clone this fork locally. (Then again, that makes me think: does that mean you could use a modified copy however you want, as long as you only do it over GitHub CI?)

sph 2y ago

I wish there were more standard open-but-not-open-source licenses available. Or open-but-only-for-personal-use or open-but-cannot-distribute. Something standard and vetted enough that projects like these could adopt instead of having to write themselves.

hnlmorg 2y ago
They didn’t really write this license themselves. It was Microsoft license that they slightly adapted after someone complained they couldn’t contribute. The real issue here is that the product wasn’t open source despite being advertised as such. The licensed they used, Microsoft Reference Source License, isn’t an open source license. It’s more accurately described as “source available”. Ie you can view the source but you’re not really allowed to use it for anything.
ksec 2y ago
>I wish there were more standard open-but-not-open-source licenses available. Or open-but-only-for-personal-use or open-but-cannot-distribute. Source Available. Something like Unreal or ONCE.
- lifthrasiir 2y ago
  I think that label is also already taken, because "source availability" doesn't imply an ability to rebuild it from the source or even make a suggestion. I guess there should be some compositional keywords for different aspects of non-F/OSS but not completely proprietary licenses. Source available, artifact buildable, artifact distributable under some conditions, etc.
  - ksec 2y ago
    Or Shared Source ?
jjmarr 2y ago
Creative Commons has standardized non-commercial and no-derivatives licences. https://creativecommons.org/share-your-work/cclicenses/ https://creativecommons.org/share-your-work/cclicenses/ This covers some of the use cases you describe.

syockit 2y ago

I checked the Wayback Machine to see how the about page for cyph looked like [1], and it said "open source", not "Open Source". So, I don't get what the beef is about. [1] https://web.archive.org/web/20200517031524/https://www.cyph.com/about https://web.archive.org/web/20200517031524/https://www.cyph....

mnky9800n 2y ago

You know what I hate about these days is this is a blog I enjoyed but then I got to the post about hacktoberfest and it occurred to me, what if this was all written to advertise hacktoberfest and the author got paid in some way for this? What bothers me about it isn't whether or not it happened, it's that I questioned the authenticity of the author simply because he posted a link and what if he did so because he was paid to do so as opposed to simply being interested. Which is exactly the internet I want to live in. One where people write interesting things and share links to other interesting things.

edent 2y ago
I can exclusively reveal that I have received several t-shirts from Hacktoberfest. Indeed, I'm wearing one right now. My laptop also has many of their stickers. They didn't pay me to write this blog though. Of course, you have no way of knowing if that's true. Just as I have no way of knowing if you were paid by a rival to spread discord.
- mnky9800n 2y ago
  My point isn't that this happened. I don't think anyone did anything other than write and read a blog post. It's that we exist in a world where it could and therefore the thought that I might need to question the authenticity of things is ever present which I find troublesome.
  - edent 2y ago
    This isn't a modern problem. Shakespeare was paid handsomely by the Crown - hence his somewhat hagiographic biographies. You will never find writing which is free from bias and influence. You can either make peace with that and find ways to mitigate against it, or you can remain in distress.
    - mnky9800n 2y ago
      I choose peace.

webprofusion 2y ago

Agree it's complex, and when attempting to solve a particular problem you end up with yet another license every time. What businesses in particular want is a "Yes, you can read the code and yes you help if you want to, but you can't use the code to make your own product" source-available license (because they have devs to pay, and being able to keep doing that is the first thing they need to protect). I think such licenses do sort of exist but they're fragmented. The root of this particular argument seems to the definition of Open Source meaning unconstrained use of source code, instead of source-available.

jusomg 2y ago

I will only add that non-standard licenses also hurt adoption, specifically in medium/big businesses/enterprises. Most organizations understand common open source licenses and there's usually a blank statement that allows teams to use GPL/MIT/whatever-licensed software. Anything outside that subset of licenses (even if they're permissive, open source or whatnot) requires a legal review and a lot of people won't go through the pain of that process just to use a library/service/app. It's easier to just choose something else.

Doctor_Fegg 2y ago
> specifically in medium/big businesses/enterprises. This is a feature, not a bug.
- School-Cotton 2y ago
  If you don’t want big companies to use your code just make it GPL, which is usually banned.
draw_down 2y ago
[dead]
School-Cotton 2y ago
> there's usually a blank statement that allows teams to use GPL/MIT/whatever-licensed software. In my experience: MIT yes, GPL no.

rambambram 2y ago

Please fit in the exact little box that I have of you in my mind and stop deciding for yourself what you want to do with your stuff. I beg your pardon!?

anilakar 2y ago

In other words, please stop pretending you're open source.

surfingdino 2y ago

Microsoft dropping "open source" licenses into the Open Source ecosystem? Why am I not surprised? The ghosts of their "Linux is Cancer" campaign just cannot die.

phkahler 2y ago

Going one level up from the title one should want to avoid OSI licenses. Their original purpose was to approve new licenses. MIT, BSD, and the GPLs already existed, so OSI "approving" more was IMHO not very helpful. Anyone not satisfied with those options was usually trying to add some level of control. Even with a well written new license you cause developers problems wondering about "license compatibility" when they try to combine code under different licenses - a practice that is really useful but often overlooked by license creators.

JimDabell 2y ago
All new licenses that apply for OSI certification have to fill a gap that existing licenses don’t cover: https://opensource.org/licenses/review-process https://opensource.org/licenses/review-process
- firesteelrain 2y ago
  I haven’t looked but taking what the author is saying at face value - there are 100 unique gaps requiring 100 new licenses?!
  - JimDabell 2y ago
    No. The author pointed out there are over 100 OSI licenses, not over 100 new OSI licenses. Many of those are pre-existing licenses, superseded licenses, etc.
    - firesteelrain 2y ago
      You said “ new licenses that apply for OSI certification have to fill a gap that existing licenses don’t cover” That was my point - there are 100+ gaps?
      - JimDabell 2y ago
        No. I’m not sure what you aren’t understanding? There are 100+ total, not 100+ new.

deleted 2y ago

[deleted]

LadyCailin 2y ago

I’ve created a non-toy programming language, and at some point I intend on creating a package manager for it. The official repository for packages will require all code to be open source, and I’ve already decided to be opinionated about what that means. I’ll pick a handful of well known, and actual open source licenses (MIT, GPL, BSD, Apache Commons, etc) and require people that want to upload to this repo to select their license from the finite list. If they want to use another license, they are still free to do so, but they’ll have to stand up their own repository, and get users to add the repo to their sources list. There’s just too many licenses, each with different (sometimes incompatible) requirements, so one advantage to being so opinionated is that you can add automatic checks to ensure you’re in compliance. For instance, if your library is MIT (only), you can’t use GPL dependencies. Most people probably don’t know this, so having tooling that helps enforce this ought to make things more compliant overall.

j16sdiz 2y ago

TFA: > What does "intended" mean here? I don't understand what problem the author have. We have lots of law and case based on intention.

edent 2y ago
Which ones specifically?
- jasonlotito 2y ago
  Easier to ask which ones do not. Intent is all over the place in law. Seriously, I'm normally one for supporting providing citation, but just look up criminal intent, or intent in law, especially in the context of the US. The most well known intent based law is manslaughter. You killed someone but didn't intend to, as opposed to murder, where you did intend to. But intent is all over law. It's similar to motive in that both are dependent on what the person is thinking. Intent being why they are buying the knife (to cut a steak), and motive being why they are using the knife (they are hungry).

eddiejaoude 2y ago

So many companies try to scam the community, by calling themselves open source but many are not. Great to see you checked and called them out. We should support and reward the real companies that are actually open source, and who care about the community and transparency!

sneak 2y ago

This article could be summed up with “many projects are engaging in open source/free software cosplay”. There are lots of projects that claim to be open source, and either are lying/don’t have free software licenses (CapRover, for example), or don’t work like an open source project is expected to (VS Code, Chromium), denying patches being integrated even if they fit project standards and provide benefit to users.

b_shulha 2y ago

This is why I like Fair Source License. It protects the company's IP but gives a community legal ways to contribute & use software for their needs. https://fsl.software https://fsl.software

michaelmior 2y ago
The link you gave is to the Functional Source License. Did you mean to use a different link? If you were referring to the Functional Source License, it's worth noting that it is explicitly not open source.
- b_shulha 2y ago
  Right, that's a good addition. Thanks. However, it solves problems the author mentions in his article: you can freely contribute and use the software as you wish, just don't create a competitive company using the recent versions of the sources. And in 2 years the code becomes true OSS - either MIT or Apache 2.0 (or anything else you want - the FSL itself is pretty short so you can easily adjust it to your needs without spending hours on lawyer consultations). BTW, the FSL is driven by Sentry, and they have created an org to cover the fair usage licensing: https://fair.io https://fair.io (that's why I have mistyped the FSL name in the original comment).
  - b_shulha 2y ago
    This is the core part of FSL-1.1-Apache-2.0. For MIT it is the same, just the "Grant of Future License" paragraph mentions the corresponding license. --- License Grant Subject to your compliance with this License Grant and the Patents, Redistribution and Trademark clauses below, we hereby grant you the right to use, copy, modify, create derivative works, publicly perform, publicly display and redistribute the Software for any Permitted Purpose identified below. Permitted Purpose A Permitted Purpose is any purpose other than a Competing Use. A Competing Use means making the Software available to others in a commercial product or service that: substitutes for the Software; substitutes for any other product or service we offer using the Software that exists as of the date we make the Software available; or offers the same or substantially similar functionality as the Software. Permitted Purposes specifically include using the Software: for your internal use and access; for non-commercial education; for non-commercial research; and in connection with professional services that you provide to a licensee using the Software in accordance with these Terms and Conditions.

ordu 2y ago

Mostly unrelated to the article, but the title stirred up memories. ~20 years ago I stumbled across the "Ё" license, that granted you all rights you can dream of with one condition, you must use the letter "ё" in its right place all the time. It is a Russian story, with some people loving "ё" and whining that outside of children books you can't find it, and other people trolling the first group by arguing that "ё" was a stupid addition from the very beginning, and even more stupid now. Sadly I cannot google the text of the license now.

School-Cotton 2y ago
How often is ё really used by native speakers?
- ordu 2y ago
  I cannot say numbers, because I don't watch for them... So I took a blog I read regularly, and counted top level comments to some post, I got 10 people used it, 4 didn't use, and 8 didn't use words with "ё", so I cannot say, do they use "ё" or not. So, it seems people use it pretty often. But books "for adults" for some reason use "ё" only when replacing it with "е" leads to ambiguity.

deleted 2y ago

[deleted]

pchangr 2y ago

Reminds me of the old “Standards” xkcd https://xkcd.com/927/ https://xkcd.com/927/

notfed 2y ago

Also worth mentioning that, in the time since this article was written, Signal Messenger is now post-quantum secure [1], and has always been free and actually open source. [1] https://signal.org/blog/pqxdh/ https://signal.org/blog/pqxdh/

buu700 2y ago

Cyph cofounder here. To be clear, the primary purpose of the license change was to allow users to validate reproducible builds of our code against the production version of Cyph without fear of technically violating the Ms-RSL license. OP's feedback was appreciated, but mostly unrelated to the license change except insofar as it reminded me to touch base with our counsel on the topic. If there's an alternative license to the Cyph-RSL that meets our needs, I'd be happy to consider it, but I don't see any particular problem with the fact that we authored our own.

mihaic 2y ago

Almost all of the existing licenses were designed many years ago, before LLMs and enterprise cloud abused the open source model. Only half jokingly, I wanted a couple months ago to change the license of a Javascript project I made to allow anyone to do anything with it, except train LLMs on it [1]. I couldn't find anything, so I cobbled together something which I'm sure is not in proper legalize. What were my options otherwise? [1] https://github.com/mciucu/stemjs/blob/master/LICENSE https://github.com/mciucu/stemjs/blob/master/LICENSE

majewsky 2y ago
Not a lawyer, so take what I say with a grain of salt, but I expect this license to be unenforceable because the statement in paragraph 1 contradicts the very broad grant in paragraph 2.