7 ms·

(Supabase ceo) I’ll revisit this with legal to try make it clearer. Our intentions here are clear - if people have examples that we can follow we will do what

(Supabase ceo) I’ll revisit this with legal to try make it clearer. Our intentions here are clear - if people have examples that we can follow we will do what we can to make this irrevocable (even to the extent of donating the patent if/when the community are ready to bear the cost of the maintainance)

gobdovan 1y ago
Can you acquire atlasgo too, or is that still on the secret roadmap?
- kiwicopple 1y ago
  we will have something to announce in this space within a few months (if the atlasgo team are reading this feel free to reach out too)
  - jacquesm 1y ago
    This is highly unprofessional.
916c0553e164269 1y ago
Appreciate the intent! For practical adoption, especially in larger orgs, OSI-approved licences are much easier to get through legal review than custom ones.
- kiwicopple 1y ago
  The current license is PostgreSQL (which is OSI approved) We could also change to MIT/Apache but we feel PostgreSQL is more appropriate given our intentions to upstream the code
  - crote 1y ago
    > The current license is PostgreSQL That's just not true. Your license[0] adds a clause to the Postgresql license[1]. This makes it a different license, which by extension also means it isn't OSI approved. It's the same with the BSD licenses[2]: the 4-clause one is OSI-approved, whereas the 3-clause one is not. Turns out that one additional "all advertising must display the following acknowledgement" clause was rather important - and so is your lawsuit clause. [0]: https://github.com/orioledb/orioledb?tab=License-1-ov-file https://github.com/orioledb/orioledb?tab=License-1-ov-file [1]: https://github.com/postgres/postgres?tab=License-1-ov-file https://github.com/postgres/postgres?tab=License-1-ov-file [2]: https://en.wikipedia.org/wiki/BSD_licenses#4-clause_license_(original_%22BSD_License%22) https://en.wikipedia.org/wiki/BSD_licenses#4-clause_license_...
    - nightpool 1y ago
      (er, surely it's the other way around? the 3-clause one is OSI approved and the 4-clause one is not) Anyway, I'm not sure this is true. Having a separate software license + secondary patent grant license is very very common in open source projects where patent trolls are common. See e.g. https://aomedia.org/about/legal/ https://aomedia.org/about/legal/ I would just put them in separate files and then you're good to go.
      - joshuaissac 1y ago
        I like how well-thought-out the licence revocation clause of the AOMedia patent licence is. It takes effect when a licensee sues over an implementation specifically over the relevant patent claims--so lawsuits unrelated to these patent claims are allowed (so if you infringe on other patents but also implement the licensed patent in the same implementation, the rights holder of the other patents can sue you over those claims without losing their licence)--and there is also a carve-out for counterclaims, and lawsuits to enforce this licence. But I am not sure if the first exemption is necessarily a good thing. The Apache License, Version 2.0 is broader in what may be grounds for patent licence termination. So it is a better deterrent against patent trolls (even if that means some legitimate patent claims are also discouraged).
  - limagnolia 1y ago
    The PostgreSQL license does not have a termination clause, you added that. I see that you are trying to use the PostgreSQL license as the basis and simply add the patent clause onto it, but it fundamentally changes the license. I hope you can look at the Apache 2 patent grant as a better clause- or even adopt something like Google's Additional IP License found here- https://www.webmproject.org/license/additional/ https://www.webmproject.org/license/additional/, which doesn't modify the open source license but instead adds an additional grant as a separate license. Supabase is doing great work, thank you!
tux3 1y ago
Google has a strong patent shield situation with AV1. Despite burning interest from patent trolls, no one is going after AOMedia members directly.
- nightpool 1y ago
  Agree with this—the A/V media system has some of the most active patent trolls around. https://aomedia.org/license/patent-license/ https://aomedia.org/license/patent-license/ The relevant patent license is the following: > 1.3. Defensive Termination. If any Licensee, its Affiliates, or its agents initiates patent litigation or files, maintains, or voluntarily participates in a lawsuit against another entity or any person asserting that any Implementation infringes Necessary Claims, any patent licenses granted under this License directly to the Licensee are immediately terminated as of the date of the initiation of action unless 1) that suit was in response to a corresponding suit regarding an Implementation first brought against an initiating entity, or 2) that suit was brought to enforce the terms of this License (including intervention in a third-party action by a Licensee).
oefrha 1y ago
Facebook famously dropped Patents from their BSD + Patents for React and a bunch of other projects, and went MIT unencumbered. https://engineering.fb.com/2017/09/22/web/relicensing-react-jest-flow-and-immutable-js/ https://engineering.fb.com/2017/09/22/web/relicensing-react-...
- deleted 1y ago
  [deleted]
- cyphar 1y ago
  The whole patents kerfuffle with Facebook was about a larger issue with their patent grant. Critically the issue was that it practically stopped you from suing Facebook for any patent issues (not just those granted for React, which would be more like the standard reactive termination clause), including counter-suits. Here is the key text from their patent license: The license granted hereunder will terminate, automatically and without notice, for anyone that makes any claim (including by filing any lawsuit, assertion or other action) alleging (a) direct, indirect, or contributory infringement or inducement to infringe any patent: (i) by Facebook or any of its subsidiaries or affiliates, whether or not such claim is related to the Software, (ii) by any party if such claim arises in whole or in part from any software, product or service of Facebook or any of its subsidiaries or affiliates, whether or not such claim is related to the Software, or (iii) by any party relating to the Software; or (b) that any right in any patent claim of Facebook is invalid or unenforceable. And so that was a fairly justified reaction IMHO. Funnily enough, it seems that the license written by Supabase has the same issue -- I suspect this might just be the "default approach" for patent lawyers. However, MIT has _no_ patent protections and is strictly worse than almost any license with some patent protections for users included. The modern landscape of software patent trolls is far less insane than it was in the 90s but I would really think twice about using something that is likely patented under a license other than Apache-2.0, MPLv2, or GPLv3.
tomnipotent 1y ago
The existing Postgres license already has an "as is" disclaimer, so adding this clause means you want to _punitively_ punish companies that sue you for reasons outside of this software. The interpretation then is you want to punish users of your software that find themselves in a (potentially legitimate) situation to sue you over unrelated matters. For example, if Supabase failed to pay a vendor that happened to use OrioleDB they wouldn't be able to sue you for damages without compromising their stack. That's uncool. My take-away from the Facebook/React license issue was that the community agrees this violates the spirit of FOSS and invalidates claiming to be open source (at least OSI-approved), with many taking offense to the punitive nature of the clause. Granted Facebook was in a position to see litigation over a lot more reasons.
kiwicopple 1y ago
fixed - sorry about the confusion. https://github.com/orioledb/orioledb/pull/558 https://github.com/orioledb/orioledb/pull/558 It is now Apache 2.0 which grants patent rights and can be re-licensed to PostgreSQL when the code is upstreamed. I'll amend the blog to make that clearer.
- tristan957 1y ago
  Thanks for the quick fix.
- rectang 1y ago
  Kudos to your legal team for working with you to provide a quick response. Licensing grants are momentous decisions it exceeds my expectations for you to act within the span of hours.
- 916c0553e164269 1y ago
  This change looks much better, thanks! > "It is now Apache 2.0 which grants patent rights and can be re-licensed to PostgreSQL when the code is upstreamed." It’s worth double-checking the relicensing angle. Imho: you can only relicense your own code. Any 3rd party contribution stays under apache 2.0 unless the author explicitly agrees. So a full switch to postgresql license is only possible if every contributor signs off. That usually means having a Contributor License Agreement (CLA) in place up front. And ethically, contributors should already know their work might be relicensed under "postgresql terms" later - otherwise it's a surprise change for the community. ps: if the plan is serious, do the legal homework early and gather consents now, so upstreaming to postgresql doesn’t fail later because a few open-source contributors (who aren’t supabase/orioledb employees) are unreachable.)
  - kiwicopple 1y ago
    Great, thanks for this - we’ll make sure we have something in place
    - kam 1y ago
giancarlostoro 1y ago
Have them look at, and consider just adopting the MS-PL? https://opensource.org/license/ms-pl-html https://opensource.org/license/ms-pl-html Microsoft used it a ton, until they eventually just made everything open-source fall under the MIT license. Some people will still be angry about it (I got a downvote for just mentioning it elsewhere on this thread) but as the person who built your software, you have every right to license your software as you deem necessary. There is a cost to what you've built and you have no true obligation to give everything for free. On that note, as far as I can remember the MS-PL is OSI approved already.

gobdovan 1y ago

Can you acquire atlasgo too, or is that still on the secret roadmap?

kiwicopple 1y ago
we will have something to announce in this space within a few months (if the atlasgo team are reading this feel free to reach out too)
- jacquesm 1y ago
  This is highly unprofessional.

916c0553e164269 1y ago

Appreciate the intent! For practical adoption, especially in larger orgs, OSI-approved licences are much easier to get through legal review than custom ones.

kiwicopple 1y ago
The current license is PostgreSQL (which is OSI approved) We could also change to MIT/Apache but we feel PostgreSQL is more appropriate given our intentions to upstream the code
- crote 1y ago
  > The current license is PostgreSQL That's just not true. Your license[0] adds a clause to the Postgresql license[1]. This makes it a different license, which by extension also means it isn't OSI approved. It's the same with the BSD licenses[2]: the 4-clause one is OSI-approved, whereas the 3-clause one is not. Turns out that one additional "all advertising must display the following acknowledgement" clause was rather important - and so is your lawsuit clause. [0]: https://github.com/orioledb/orioledb?tab=License-1-ov-file https://github.com/orioledb/orioledb?tab=License-1-ov-file [1]: https://github.com/postgres/postgres?tab=License-1-ov-file https://github.com/postgres/postgres?tab=License-1-ov-file [2]: https://en.wikipedia.org/wiki/BSD_licenses#4-clause_license_(original_%22BSD_License%22) https://en.wikipedia.org/wiki/BSD_licenses#4-clause_license_...
  - nightpool 1y ago
    (er, surely it's the other way around? the 3-clause one is OSI approved and the 4-clause one is not) Anyway, I'm not sure this is true. Having a separate software license + secondary patent grant license is very very common in open source projects where patent trolls are common. See e.g. https://aomedia.org/about/legal/ https://aomedia.org/about/legal/ I would just put them in separate files and then you're good to go.
    - joshuaissac 1y ago
      I like how well-thought-out the licence revocation clause of the AOMedia patent licence is. It takes effect when a licensee sues over an implementation specifically over the relevant patent claims--so lawsuits unrelated to these patent claims are allowed (so if you infringe on other patents but also implement the licensed patent in the same implementation, the rights holder of the other patents can sue you over those claims without losing their licence)--and there is also a carve-out for counterclaims, and lawsuits to enforce this licence. But I am not sure if the first exemption is necessarily a good thing. The Apache License, Version 2.0 is broader in what may be grounds for patent licence termination. So it is a better deterrent against patent trolls (even if that means some legitimate patent claims are also discouraged).
- limagnolia 1y ago
  The PostgreSQL license does not have a termination clause, you added that. I see that you are trying to use the PostgreSQL license as the basis and simply add the patent clause onto it, but it fundamentally changes the license. I hope you can look at the Apache 2 patent grant as a better clause- or even adopt something like Google's Additional IP License found here- https://www.webmproject.org/license/additional/ https://www.webmproject.org/license/additional/, which doesn't modify the open source license but instead adds an additional grant as a separate license. Supabase is doing great work, thank you!

tux3 1y ago

Google has a strong patent shield situation with AV1. Despite burning interest from patent trolls, no one is going after AOMedia members directly.

nightpool 1y ago
Agree with this—the A/V media system has some of the most active patent trolls around. https://aomedia.org/license/patent-license/ https://aomedia.org/license/patent-license/ The relevant patent license is the following: > 1.3. Defensive Termination. If any Licensee, its Affiliates, or its agents initiates patent litigation or files, maintains, or voluntarily participates in a lawsuit against another entity or any person asserting that any Implementation infringes Necessary Claims, any patent licenses granted under this License directly to the Licensee are immediately terminated as of the date of the initiation of action unless 1) that suit was in response to a corresponding suit regarding an Implementation first brought against an initiating entity, or 2) that suit was brought to enforce the terms of this License (including intervention in a third-party action by a Licensee).

oefrha 1y ago

Facebook famously dropped Patents from their BSD + Patents for React and a bunch of other projects, and went MIT unencumbered. https://engineering.fb.com/2017/09/22/web/relicensing-react-jest-flow-and-immutable-js/ https://engineering.fb.com/2017/09/22/web/relicensing-react-...

deleted 1y ago
[deleted]
cyphar 1y ago
The whole patents kerfuffle with Facebook was about a larger issue with their patent grant. Critically the issue was that it practically stopped you from suing Facebook for any patent issues (not just those granted for React, which would be more like the standard reactive termination clause), including counter-suits. Here is the key text from their patent license: The license granted hereunder will terminate, automatically and without notice, for anyone that makes any claim (including by filing any lawsuit, assertion or other action) alleging (a) direct, indirect, or contributory infringement or inducement to infringe any patent: (i) by Facebook or any of its subsidiaries or affiliates, whether or not such claim is related to the Software, (ii) by any party if such claim arises in whole or in part from any software, product or service of Facebook or any of its subsidiaries or affiliates, whether or not such claim is related to the Software, or (iii) by any party relating to the Software; or (b) that any right in any patent claim of Facebook is invalid or unenforceable. And so that was a fairly justified reaction IMHO. Funnily enough, it seems that the license written by Supabase has the same issue -- I suspect this might just be the "default approach" for patent lawyers. However, MIT has _no_ patent protections and is strictly worse than almost any license with some patent protections for users included. The modern landscape of software patent trolls is far less insane than it was in the 90s but I would really think twice about using something that is likely patented under a license other than Apache-2.0, MPLv2, or GPLv3.

tomnipotent 1y ago

The existing Postgres license already has an "as is" disclaimer, so adding this clause means you want to _punitively_ punish companies that sue you for reasons outside of this software. The interpretation then is you want to punish users of your software that find themselves in a (potentially legitimate) situation to sue you over unrelated matters. For example, if Supabase failed to pay a vendor that happened to use OrioleDB they wouldn't be able to sue you for damages without compromising their stack. That's uncool. My take-away from the Facebook/React license issue was that the community agrees this violates the spirit of FOSS and invalidates claiming to be open source (at least OSI-approved), with many taking offense to the punitive nature of the clause. Granted Facebook was in a position to see litigation over a lot more reasons.

kiwicopple 1y ago

fixed - sorry about the confusion. https://github.com/orioledb/orioledb/pull/558 https://github.com/orioledb/orioledb/pull/558 It is now Apache 2.0 which grants patent rights and can be re-licensed to PostgreSQL when the code is upstreamed. I'll amend the blog to make that clearer.

tristan957 1y ago
Thanks for the quick fix.
rectang 1y ago
Kudos to your legal team for working with you to provide a quick response. Licensing grants are momentous decisions it exceeds my expectations for you to act within the span of hours.
916c0553e164269 1y ago
This change looks much better, thanks! > "It is now Apache 2.0 which grants patent rights and can be re-licensed to PostgreSQL when the code is upstreamed." It’s worth double-checking the relicensing angle. Imho: you can only relicense your own code. Any 3rd party contribution stays under apache 2.0 unless the author explicitly agrees. So a full switch to postgresql license is only possible if every contributor signs off. That usually means having a Contributor License Agreement (CLA) in place up front. And ethically, contributors should already know their work might be relicensed under "postgresql terms" later - otherwise it's a surprise change for the community. ps: if the plan is serious, do the legal homework early and gather consents now, so upstreaming to postgresql doesn’t fail later because a few open-source contributors (who aren’t supabase/orioledb employees) are unreachable.)
- kiwicopple 1y ago
  Great, thanks for this - we’ll make sure we have something in place
  - kam 1y ago

giancarlostoro 1y ago

Have them look at, and consider just adopting the MS-PL? https://opensource.org/license/ms-pl-html https://opensource.org/license/ms-pl-html Microsoft used it a ton, until they eventually just made everything open-source fall under the MIT license. Some people will still be angry about it (I got a downvote for just mentioning it elsewhere on this thread) but as the person who built your software, you have every right to license your software as you deem necessary. There is a cost to what you've built and you have no true obligation to give everything for free. On that note, as far as I can remember the MS-PL is OSI approved already.