9 ms·

Ask HN: Is it safe to use Facebook's open source projects?

160 points by kfei 12y ago

There is a PATENTS file in almost all Facebook's open source projects with statements on "Additional Grant of Patent Rights". E.g., React (https://github.com/facebook/react/blob/master/PATENTS) Why Facebook adds this declaration on top of the BSD license of the software? Is it safe to use those projects in my commercial project?

bencollier49 12y ago
Hmm, interesting. The grant of rights looks as though it's designed to build a defense against patent claims against Facebook. Get everyone using their stuff, and anyone who does will find it quite difficult to challenge Facebook patents.
powatom 12y ago
IANAL, but does this just mean that you can use and amend their work, but you can't create the same basic thing from scratch and claim that you created it?
DougBTX 12y ago
IANAL, but shouldn't you be more concerned about open source projects which don't grant you patent rights required to use the software?
- pbhjpbhj 12y ago
  Do [m|]any open source projects hold patents?
ramchip 12y ago
Discussion: https://news.ycombinator.com/item?id=8985541 https://news.ycombinator.com/item?id=8985541
- nostrademons 12y ago
  Also here, which IMHO is more informative: https://news.ycombinator.com/item?id=8901357 https://news.ycombinator.com/item?id=8901357
  - stupidcar 12y ago
    Yeah, this discussion points out an important point that it's easy to miss if you scan Facebook's patent grant: The license Facebook grants you is invalidated by any action that even alleges that any of Facebook's patents is invalid. E.g. if you so much as Tweet that one of Facebook's patents, even one entirely unrelated to React, is invalid, you've lost your license. Compare this with the patent grant in the Apache license, as used in a library like Angular: https://github.com/angular/angular/blob/master/LICENSE https://github.com/angular/angular/blob/master/LICENSE Here the license is only terminated in the event that you institute litigation alleging patent infringement by the software itself. You're still free to challenge shitty patents and call out companies about them. Not so with Facebook's license.
    - pbhjpbhj 12y ago
      This is an interesting thing (to me!). Can you give a license that says, words to the effect, that if one accuses you of a crime then the license is revoked? This would make licenses beholden to not report the licensor for criminal activities. IPR infringements tend to be torts, which is different, but I'm still interested in how far you can push license terms before something in the law, USC here presumably, pushes back and says "woah, you can't do that". Anyone?
    - fncypants 12y ago
      No. In context it refers to "filing any ... action." Lawsuits and similar procedures in other legal forums are often called actions. Think the movie called A Civil Action staring John Travolta about a civil lawsuit. The concern here is not how it is triggered (it must be by a lawsuit or something similar) but rather the balance of power it provides if you get into a war with Facebook, since you cannot undo having used their software.
      - nostrademons 12y ago
        In DannyBee's original post, he says that the key words there are "for anyone that makes any claim (including by filing any lawsuit, assertion or other action)", and that by including the words for "assertion or other action", it encompasses claims outside of a court of law. A post on Hacker News or a tweet on Twitter is an assertion, and so would fall under this. Otherwise why include that language? IANAL, but he is, and this is his area of expertise (IIRC he runs the open-source program for Google).
rurban 12y ago
It is safer than using SW without those "Additional Grant of Patent Rights". They explictly state that you can use it, other didn't make the effort to check for patents, or simply can screw you later.
lmm 12y ago
There is no way to be safe from patents. Anyone could have them, they don't have to declare them, and they're written in deliberately obtuse ways so that you have no way of finding relevant patents before you're sued for infringing them (you don't have to have copied, or even be aware of, any patented thing to violate a patent). It's just a hazard of the software industry. The BSD license says nothing about patents, so this project is in some sense safer than a "normal" BSD-licensed project (but not an Apache, EPL or GPLv3-licensed project). The grant Facebook is giving you is fairly minimal but that's understandable from their perspective: they don't want to give you any extra patent rights, just enough to use the stuff they're actually trying to release. It's not safe to use software in a commercial project. Facebook might hold patents on any random library you're using. Companies that aren't Facebook might hold patents on any random library or on React. You could develop a library in-house in a clean room and it could still infringe someone else's patent. Patents really suck that way. But React is in no more danger than any other code you might use. EDIT: no more danger than any other BSD-licensed code. It would be safer to use code that has a less revocable patent grant, such as that in the Apache License, EPL, or GPLv3.
- kibibu 12y ago
  As I understand it, you're better off not looking for relevant patents so that you can claim accidental infringement rather than wilful infringement
  - alandarev 12y ago
    It would be nice to find and share if React infringes any of the patents.
  - cma 12y ago
    Only if your company would survive half-damages and not survive full-damages, or probably a more complex weighted calculation. Doesn't seem too likely, especially if looking can help you do trivial workarounds to avoid infringing at all.
- lettergram 12y ago
  FYI my favorite patent ever is from Facebook: "A social networking system user may associate an emoji representing the user's emotional reaction with a content item presented by the social networking system. The user is presented with one or more emoji maintained by the social networking system and selects an emoji for associating with the content item." [1] http://www.google.com.ar/patents/US8918339 http://www.google.com.ar/patents/US8918339 That's right folks, they patented using the emoji to respond to content.
matthewmacleod 12y ago
Of course it is – you've got this back to front. The grant of additional rights to use any patent Facebook may hold is an additional benefit and in no way places any restriction on you. If you're going to worry about anything, worry about the squillions of open-source projects that don't include any patent grants. But you probably shouldn't worry about that either.
- vertex-four 12y ago
  Most open-source projects' owners and contributors don't have any patents to enforce, thus can't grant anything. The rest tend to be less chilling than the clause that Facebook uses - there's no "we'll only grant you this if you promise never to mention that any of our patents might be invalid". Are you certain that Facebook doesn't have any patents that cover any of its open-source software?
SixSigma 12y ago
No. The license has a chilling clause that says if you ever suggest that any Facebook patent might be invalid, your license to use their code is automatically revoked. And in corporate world, that means any comment of any of your employees in an official capacity. Edit downvotes, well maybe the text of the clause will help > The license granted hereunder will terminate, automatically and without notice, for anyone that makes any claim ... by ... assertion or other action ... alleging .. that any right in any patent claim of Facebook is invalid or unenforceable. > https://github.com/facebook/fbcunn/blob/master/PATENTS https://github.com/facebook/fbcunn/blob/master/PATENTS
- randunel 12y ago
  So... I think Facebook has at least one unenforceable patent in my country. There, I may no longer use their code :D
- callum85 12y ago
  Who is downvoting this? Could you comment and explain why?
  - SixSigma 12y ago
    Was probably because I asserted it without citation.
- kriro 12y ago
  Thanks for sharing this. It brings up some interesting questions. Does this mean React cannot be used by European government agencies since they claim (via law) that patents are not enforcable? What if I merely live in the EU and thus implicitly agree to the laws in Europw. Does that fall under "other action" or would I have to explicitly state that I think their patents are not enforceable. What if I have actively participated in the anti software patents movement? Do I have to single out specific Facebook patents for this clause to trigger or is it enough that they are caught in the general umbrella? Edit: I'm assuming this is found on all the stuff they release and not just fbcunn? At least it's also true for react: https://github.com/facebook/react/blob/master/PATENTS https://github.com/facebook/react/blob/master/PATENTS
mobiplayer 12y ago
The best way to stay safe from software patents is to not enter the US market, if you can afford that :)
pretaliationc 12y ago
Pardon my ignorance, but isn't this just equivalent to Apache's patent retaliation clause?[0][1] [0] http://en.swpat.org/wiki/Patent_clauses_in_software_licences#Apache_License_2.0 http://en.swpat.org/wiki/Patent_clauses_in_software_licences... [1] http://en.wikipedia.org/wiki/Software_patents_and_free_software#Patent_retaliation http://en.wikipedia.org/wiki/Software_patents_and_free_softw...
- richardfontana 12y ago
  The events that trigger Apache License 2.0 patent termination are much narrower: "If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed."
  - spacemanmatt 12y ago
    Yeah, Apache is a little more giving in actual terms, but it's a similar deal.
dutchbrit 12y ago
It all boils down to the license - open source means jack all.
jonas21 12y ago
Facebook is granting you additional rights on top of the BSD license. In the worst case, where you do something that causes the patent rights to be revoked, you're still left with the same rights you have under the BSD license. This is unambiguously safer to use than if they had released it under a vanilla BSD license. As for why Facebook did this, they're most likely trying to give away additional rights while still maintaining the ability to use these patents defensively, in the event someone sues them for infringing a different patent. It's ironic that people are freaking out about this. If anything, we should be encouraging more companies to give away patent rights. Sure, it's not as broad as the Apache license, but it's a lot better than the default (nothing), and given some of the ridiculous patent lawsuits that have been brought against Facebook, Google, and others, I can understand why they'd want to avoid restricting their ability to use their patents defensively.
- DannyBee 12y ago
  "Facebook is granting you additional rights on top of the BSD license. In the worst case, where you do something that causes the patent rights to be revoked, you're still left with the same rights you have under the BSD license. This is unambiguously safer to use than if they had released it under a vanilla BSD license. As for why Facebook did this, they're most likely trying to give away additional rights while still maintaining the ability to use these patents defensively, in the event someone sues them for infringing a different patent. " This is 100% totally and completely wrong :) The BSD license normally includes an implied patent license. It says " Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met .. " This grants an implied patent license to the patents necessary to actually do this, as long as you meet the restrictions. This is actually well settled law. You don't get to give people stuff unrestricted, and say "you can use this for free", and then say "just kidding, what i meant was, you can use this for free as long as you pay me for the patents" However, when you do what facebook has done, and give an explicit license, you have overwritten the terms of that implied license, and you get no implied license. So it is not only "not unambiguously safer", you are not "left with the same rights you had under the bsd license if it is revoked". This is because if you revoke the explicit grant, you get nothing in terms of patents. But the implicit grant is not revokable unless you violate the copyright license. So sorry, but this is not "better than the default" and does not in fact, help you.
anonbanker 12y ago
other than a) (ii) of that PATENTS file, it's way better than I thought it would be. Unless I'm reading it wrong, I'm losing my right to use the package if I publicly state that someone is misusing Facebook's software.

throwawaykf05 12y ago
Actually, if you RTFClaims (which is the first thing you should read), they patented asking for payment for using emoji to respond to content. Which is ridiculous from a business perspective as well.
- sanxiyn 12y ago
  What is ridiculous about it? LINE is earning millions of dollars from exactly that. On the other hand, I think the patent is invalid because LINE predates this like a year or so.
  - btilly 12y ago
    Food for thought. For reasons that SixSigma brought up in another comment, both you and your employer have just lost your rights to the patent grant that would let you safely use Facebook's open source contributions. That's pretty bad.
    - nanidin 12y ago
      I think the word 'claim' is used a little ambiguously, but given how it is used in the rest of the patent declaration, I don't think the intent of Facebook is to stop you from saying anything about infringement, rather it is to stop you from filing a claim in court or with the patent office.
      - btilly 12y ago
        Don't worry about intent, worry about what they actually say. They have smart lawyers, and wouldn't say it if they didn't mean it. They say you lose the license if you make a claim "...that any right in any patent claim of Facebook is invalid or unenforceable." They also helpfully indicate what a claim means, and making an assertion counts. Now why would they do this? My guess is that they wanted to have a legal tool that they could use to provide a chilling effect on any third parties who might volunteer information that is useful to someone filing a lawsuit against them. Which, if you are a lawyer, might seem like a good response to the demonstrated ability of groups like groklaw to crowdsource legal research. And if they were in such a lawsuit, that comment is exactly what Facebook would not want to see. But there is no need to speculate. Their patent grant is quite clear, and the comment I pointed at is in violation.
  - throwawaykf05 12y ago
    Wow, I did not imagine people would pay for emoji. I stand corrected.

matthewmacleod 12y ago

…if you ever suggest that any Facebook patent might be invalid, your license to use their code is automatically revoked. This is not correct — your license to use any patent of Facebook's that covers the software is revoked. You are still not infringing copyright on the software by using it, but you will no longer be protected by Facebook's patent grant, which is in addition to your license to use the software. This is a boilerplate patent grant, and it doesn't mean that Facebook holds any patents on e.g. React. To be clear, this parent grant is in addition to your license to use the software and as a result does not restrict your freedom in any way, versus the license not being granted at all.

stupidcar 12y ago
While it's true that you only lose your license to the patents, not the code, I don't see how you can argue the grant isn't a restriction of your freedom? Surely any license whose conferred rights are predicated on the recipient not being able to take particular actions, up to and including saying particular things, must be considered to be restricting freedoms, even if those restrictions are in exchange for other freedoms granted? Of course, all free software licenses involve some exchange of freedoms: You give up your ability to publish closed-source modifications of the software in exchange for being able to use and modify it at all. The question is whether the freedoms you are asked to give up are reasonable in exchange for what you gain. A patent grant that restricts your freedom to launch patent infringement litigation against other users of the software seem reasonable to me. Whereas a grant that is invalidated simply by alleging, through any action, that any of the original author's patents are invalid, does not.
guscost 12y ago
Are you saying that they could not come after you for simply using React (even if you were to dispute the relevant patents in court), or just that there is no evidence that they could?
- matthewmacleod 12y ago
  Facebook cannot 'come after you' for using React if you have not accused them of patent infringement. They can 'come after you' iff you have accused them of that, and you are using their software in such a way that a parent of theirs is violated. It's pretty straightforward: - Facebook has released some open source software. In the case of React, it's under the BSD license. - You can use this software however you want, in accordance with the license. - In addition to granting you a license to use the software, Facebook has granted you a license to any patents they own that cover the software. - There is no enumeration or claim that any patents do cover the software. - Your license to use any hypothetical patent that does cover the software will be revoked if you make a claim—legal or otherwise—that Facebook has infringed any patent. - At that point, you will no longer have a license to use any patent that covers the software. - If you are subsequently using the software in a way that infringes one of their patents, Facebook would legitimately be able to claim patent infringement.
loceng 12y ago
So if you ever need to sue Facebook for patent infringement - you'll still be able to use React/React Native once they release it?