5 ms·

from the blog: "The patent is intended as a shield, not a sword, to protect Open Source from hostile IP claims." vs. the current license: "IF ANY LITIGATION

from the blog: "The patent is intended as a shield, not a sword, to protect Open Source from hostile IP claims." vs. the current license: "IF ANY LITIGATION IS INSTITUTED AGAINST SUPABASE, INC. BY A LICENSEE OF THIS SOFTWARE, THEN THE LICENSE GRANTED TO SAID LICENSEE SHALL TERMINATE AS OF THE DATE SUCH LITIGATION IS FILED." ( https://github.com/orioledb/orioledb/blob/main/LICENSE https://github.com/orioledb/orioledb/blob/main/LICENSE ) imho: the current wording might discourage state organisations, since even a trivial lawsuit (e.g. a minor tax delay) could terminate the licence - perhaps a narrower patent-focused clause would work better (or an OSI-approved licence?).

cwillu 1y ago
Or litigation from a future license violation
giancarlostoro 1y ago
Sounds like the MS-PL which Microsoft used to use but switched to MIT. MS-PL is basically MIT but cover your butt against patent litigation.
- cyphar 1y ago
  You need to read the text more carefully -- the license terminates for any litigation against Supabase at all. Hypothetically, a former employee of Supabase suing them for some employee rights violation would no longer be allowed to use the software, which is not the case for any other OSI-approved license with patent shields. The MS-PL has the fairly standard reactive patent shield that only activates for patent-related litigation for the specific software under the license and is kind of similar to the language in Apache 2.0, MPLv2, and GPLv3. But they have now switched to Apache 2.0, so crisis averted.
yellow_lead 1y ago
A shield for Supabase, not for us
Reubend 1y ago
So what? I don't see any conflict between what they said and what the license says. As they stated, it's being used as a shield. If you're suing them, you probably don't deserve a free license to their patented tech.
- graemep 1y ago
  The difference is that the license is terminated by ANY litigation against Supabase - e.g. if you sue them for breach of contract completely unrelated to the software. Use as a shield would mean limiting it to patent litigation against a user of the software. It also only covers litigation against Supabase - it does not provide a shield against litigation against OrioleDB users.
- deleted 1y ago
  [deleted]
916c0553e164269 1y ago
Apache 2.0 has a better patent clause - against hostile IP claims, so tax dispute is not terminate the OrioleDB license: "If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed." https://opensource.org/license/apache-2-0 https://opensource.org/license/apache-2-0
- crote 1y ago
  It also seems a lot less strict on what is being terminated. On violation the Apache 2.0 license terminates the patent license. I might be mistaken, but that reads an awful lot like you're still allowed to use the software provided you do so in a way which doesn't violate the patent. On the other hand, the OrioleDB license seems to terminate the entire license - so the way I read this it would include parts of the software which aren't covered under the patent itself.
  - cyphar 1y ago
    MPLv2 has a stronger version of this (I also personally prefer it in general to Apache-2.0 if you can't stomach GPLv3).
- kiwicopple 1y ago
  https://news.ycombinator.com/item?id=45200014 https://news.ycombinator.com/item?id=45200014
kiwicopple 1y ago
(Supabase ceo) I’ll revisit this with legal to try make it clearer. Our intentions here are clear - if people have examples that we can follow we will do what we can to make this irrevocable (even to the extent of donating the patent if/when the community are ready to bear the cost of the maintainance)
- gobdovan 1y ago
  Can you acquire atlasgo too, or is that still on the secret roadmap?
  - kiwicopple 1y ago
    we will have something to announce in this space within a few months (if the atlasgo team are reading this feel free to reach out too)
    - jacquesm 1y ago
      This is highly unprofessional.
- 916c0553e164269 1y ago
  Appreciate the intent! For practical adoption, especially in larger orgs, OSI-approved licences are much easier to get through legal review than custom ones.
  - kiwicopple 1y ago
    The current license is PostgreSQL (which is OSI approved) We could also change to MIT/Apache but we feel PostgreSQL is more appropriate given our intentions to upstream the code
    - crote 1y ago
      > The current license is PostgreSQL That's just not true. Your license[0] adds a clause to the Postgresql license[1]. This makes it a different license, which by extension also means it isn't OSI approved. It's the same with the BSD licenses[2]: the 4-clause one is OSI-approved, whereas the 3-clause one is not. Turns out that one additional "all advertising must display the following acknowledgement" clause was rather important - and so is your lawsuit clause. [0]: https://github.com/orioledb/orioledb?tab=License-1-ov-file https://github.com/orioledb/orioledb?tab=License-1-ov-file [1]: https://github.com/postgres/postgres?tab=License-1-ov-file https://github.com/postgres/postgres?tab=License-1-ov-file [2]: https://en.wikipedia.org/wiki/BSD_licenses#4-clause_license_(original_%22BSD_License%22) https://en.wikipedia.org/wiki/BSD_licenses#4-clause_license_...
crote 1y ago
Does the current license even allow for friendly forks, or redistribution? It starts off nice with the usual: > PERMISSION TO USE, COPY, MODIFY, AND DISTRIBUTE THIS SOFTWARE AND ITS DOCUMENTATION FOR ANY PURPOSE, WITHOUT FEE, AND WITHOUT A WRITTEN AGREEMENT IS HEREBY GRANTED .. but then there's the: > HEREBY GRANTS A (..) LICENSE TO UNITED STATES PATENT NO. 10,325,030 TO MAKE, HAVE MADE, USE, HAVE USED, OFFER TO SELL, OFFERED TO SELL, SELL, SOLD, IMPORT INTO THE UNITED STATES, IMPORTED INTO THE UNITED STATES, AND OTHERWISE TRANSFER THIS SOFTWARE .. which to me seems to be missing some kind of "modify" clause? Sure, it seems like you're allowing me to distribute it as-is the way a store like Amazon distributes boxes, but what happens when I start modifying the code and distributing those modifications? Is it still "this software", or has it become a derivative? Is the license I get to that patent even sublicensable? What happens to users of a fork when the forkee sues Supabase: do they also by extension lose their patent license? The GPLv2, for example, has a clause stating that "Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor" which makes it very clear what happens. If you're adding a poison pill to open-source code, you really shouldn't be this sloppy: it should be painfully obvious to every reader what the implications are, or nobody will ever risk using it.
- cyphar 1y ago
  A common issue with open source patent licenses is that they cannot grant blanket patent rights from contributors without some limitation around modifications, as it would allow someone to trivially render all of contributors' patents invalid (they just have to write a patch for the software that implements a patent you hold). GPLv3 has text about this in (s)11, MPLv2 has (s)2.3, and Apache-2.0 has s(3). GPLv2 doesn't have an explicit patent grant (and while some folks have argued that it has an implicit one that is just as good, I think the general consensus is that GPLv2 is not immune to patent trolls). All of them still allow you to make modifications but they do not guarantee that some other patents will not be infringed by your modifications and open you up to patent lawsuits (even from the same entity). Assuming a lawyer wrote this, this is probably part of the reason for it. But it does feel a little sloppy, a separate patent license with clear terms would probably be more preferable.

cwillu 1y ago

Or litigation from a future license violation

giancarlostoro 1y ago

Sounds like the MS-PL which Microsoft used to use but switched to MIT. MS-PL is basically MIT but cover your butt against patent litigation.

cyphar 1y ago
You need to read the text more carefully -- the license terminates for any litigation against Supabase at all. Hypothetically, a former employee of Supabase suing them for some employee rights violation would no longer be allowed to use the software, which is not the case for any other OSI-approved license with patent shields. The MS-PL has the fairly standard reactive patent shield that only activates for patent-related litigation for the specific software under the license and is kind of similar to the language in Apache 2.0, MPLv2, and GPLv3. But they have now switched to Apache 2.0, so crisis averted.

yellow_lead 1y ago

A shield for Supabase, not for us

Reubend 1y ago

So what? I don't see any conflict between what they said and what the license says. As they stated, it's being used as a shield. If you're suing them, you probably don't deserve a free license to their patented tech.

graemep 1y ago
The difference is that the license is terminated by ANY litigation against Supabase - e.g. if you sue them for breach of contract completely unrelated to the software. Use as a shield would mean limiting it to patent litigation against a user of the software. It also only covers litigation against Supabase - it does not provide a shield against litigation against OrioleDB users.
deleted 1y ago
[deleted]

916c0553e164269 1y ago

Apache 2.0 has a better patent clause - against hostile IP claims, so tax dispute is not terminate the OrioleDB license: "If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed." https://opensource.org/license/apache-2-0 https://opensource.org/license/apache-2-0

crote 1y ago
It also seems a lot less strict on what is being terminated. On violation the Apache 2.0 license terminates the patent license. I might be mistaken, but that reads an awful lot like you're still allowed to use the software provided you do so in a way which doesn't violate the patent. On the other hand, the OrioleDB license seems to terminate the entire license - so the way I read this it would include parts of the software which aren't covered under the patent itself.
- cyphar 1y ago
  MPLv2 has a stronger version of this (I also personally prefer it in general to Apache-2.0 if you can't stomach GPLv3).
kiwicopple 1y ago
https://news.ycombinator.com/item?id=45200014 https://news.ycombinator.com/item?id=45200014

kiwicopple 1y ago

(Supabase ceo) I’ll revisit this with legal to try make it clearer. Our intentions here are clear - if people have examples that we can follow we will do what we can to make this irrevocable (even to the extent of donating the patent if/when the community are ready to bear the cost of the maintainance)

gobdovan 1y ago
Can you acquire atlasgo too, or is that still on the secret roadmap?
- kiwicopple 1y ago
  we will have something to announce in this space within a few months (if the atlasgo team are reading this feel free to reach out too)
  - jacquesm 1y ago
    This is highly unprofessional.
916c0553e164269 1y ago
Appreciate the intent! For practical adoption, especially in larger orgs, OSI-approved licences are much easier to get through legal review than custom ones.
- kiwicopple 1y ago
  The current license is PostgreSQL (which is OSI approved) We could also change to MIT/Apache but we feel PostgreSQL is more appropriate given our intentions to upstream the code
  - crote 1y ago
    > The current license is PostgreSQL That's just not true. Your license[0] adds a clause to the Postgresql license[1]. This makes it a different license, which by extension also means it isn't OSI approved. It's the same with the BSD licenses[2]: the 4-clause one is OSI-approved, whereas the 3-clause one is not. Turns out that one additional "all advertising must display the following acknowledgement" clause was rather important - and so is your lawsuit clause. [0]: https://github.com/orioledb/orioledb?tab=License-1-ov-file https://github.com/orioledb/orioledb?tab=License-1-ov-file [1]: https://github.com/postgres/postgres?tab=License-1-ov-file https://github.com/postgres/postgres?tab=License-1-ov-file [2]: https://en.wikipedia.org/wiki/BSD_licenses#4-clause_license_(original_%22BSD_License%22) https://en.wikipedia.org/wiki/BSD_licenses#4-clause_license_...

crote 1y ago

Does the current license even allow for friendly forks, or redistribution? It starts off nice with the usual: > PERMISSION TO USE, COPY, MODIFY, AND DISTRIBUTE THIS SOFTWARE AND ITS DOCUMENTATION FOR ANY PURPOSE, WITHOUT FEE, AND WITHOUT A WRITTEN AGREEMENT IS HEREBY GRANTED .. but then there's the: > HEREBY GRANTS A (..) LICENSE TO UNITED STATES PATENT NO. 10,325,030 TO MAKE, HAVE MADE, USE, HAVE USED, OFFER TO SELL, OFFERED TO SELL, SELL, SOLD, IMPORT INTO THE UNITED STATES, IMPORTED INTO THE UNITED STATES, AND OTHERWISE TRANSFER THIS SOFTWARE .. which to me seems to be missing some kind of "modify" clause? Sure, it seems like you're allowing me to distribute it as-is the way a store like Amazon distributes boxes, but what happens when I start modifying the code and distributing those modifications? Is it still "this software", or has it become a derivative? Is the license I get to that patent even sublicensable? What happens to users of a fork when the forkee sues Supabase: do they also by extension lose their patent license? The GPLv2, for example, has a clause stating that "Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor" which makes it very clear what happens. If you're adding a poison pill to open-source code, you really shouldn't be this sloppy: it should be painfully obvious to every reader what the implications are, or nobody will ever risk using it.

cyphar 1y ago
A common issue with open source patent licenses is that they cannot grant blanket patent rights from contributors without some limitation around modifications, as it would allow someone to trivially render all of contributors' patents invalid (they just have to write a patch for the software that implements a patent you hold). GPLv3 has text about this in (s)11, MPLv2 has (s)2.3, and Apache-2.0 has s(3). GPLv2 doesn't have an explicit patent grant (and while some folks have argued that it has an implicit one that is just as good, I think the general consensus is that GPLv2 is not immune to patent trolls). All of them still allow you to make modifications but they do not guarantee that some other patents will not be infringed by your modifications and open you up to patent lawsuits (even from the same entity). Assuming a lawyer wrote this, this is probably part of the reason for it. But it does feel a little sloppy, a separate patent license with clear terms would probably be more preferable.